tempest-react-sdk 0.75.0 → 0.77.0

package/dist/data/create-data-provider.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"create-data-provider.cjs","names":[],"sources":["../../src/data/create-data-provider.ts"],"sourcesContent":["import type { ApiClient, RequestOptions } from \"@/http/types\";\nimport type { OffsetPage } from \"@/query/pagination\";\n\n/** Query-param values accepted by the API client for a list request. */\ntype ParamValue = string | number | boolean | undefined | null;\n\n/** Filters passed to {@link DataProvider.getList}, spread verbatim into the query string. */\nexport type DataFilters = Record<string, ParamValue>;\n\n/** Parameters for a paginated, sorted, filtered list request. */\nexport interface GetListParams {\n    /** Offset pagination — 1-based `page` and `pageSize`. */\n    pagination?: { page?: number; pageSize?: number };\n    /** Single-field sort. `order` defaults to `\"asc\"`. */\n    sort?: { field: string; order?: \"asc\" | \"desc\" };\n    /** Arbitrary filter query params, spread onto the request. */\n    filters?: DataFilters;\n}\n\n/**\n * Refine-style data provider over the Tempest FastAPI SDK CRUD/pagination\n * conventions. Implementations are stateless wrappers around an {@link ApiClient}.\n */\nexport interface DataProvider {\n    /**\n     * Fetch a paginated list of a resource.\n     *\n     * @param resource - The resource name (e.g. `\"users\"`).\n     * @param params - Pagination, sort and filter parameters.\n     * @returns The offset-paginated envelope.\n     */\n    getList<T>(resource: string, params?: GetListParams): Promise<OffsetPage<T>>;\n    /**\n     * Fetch a single record by id.\n     *\n     * @param resource - The resource name.\n     * @param id - The record id.\n     * @returns The record.\n     */\n    getOne<T>(resource: string, id: string | number): Promise<T>;\n    /**\n     * Fetch many records by id (default: parallel {@link DataProvider.getOne}).\n     *\n     * @param resource - The resource name.\n     * @param ids - The record ids.\n     * @returns The records, in the same order as `ids`.\n     */\n    getMany<T>(resource: string, ids: (string | number)[]): Promise<T[]>;\n    /**\n     * Create a record.\n     *\n     * @param resource - The resource name.\n     * @param data - The creation payload.\n     * @returns The created record.\n     */\n    create<T>(resource: string, data: unknown): Promise<T>;\n    /**\n     * Update a record (PATCH by default, PUT when configured).\n     *\n     * @param resource - The resource name.\n     * @param id - The record id.\n     * @param data - The update payload.\n     * @returns The updated record.\n     */\n    update<T>(resource: string, id: string | number, data: unknown): Promise<T>;\n    /**\n     * Delete a record by id.\n     *\n     * @param resource - The resource name.\n     * @param id - The record id.\n     * @returns The delete response (often the deleted record).\n     */\n    deleteOne<T>(resource: string, id: string | number): Promise<T>;\n}\n\n/** Options to tailor {@link createDataProvider} to a backend's conventions. */\nexport interface DataProviderOptions {\n    /** Query-param name for the page number. Default: `\"page\"`. */\n    pageParam?: string;\n    /** Query-param name for the page size. Default: `\"size\"`. */\n    sizeParam?: string;\n    /** Query-param name for the sort field. Default: `\"order_by\"`. */\n    sortFieldParam?: string;\n    /** Query-param name for the sort order. Default: `\"ascending\"`. */\n    sortOrderParam?: string;\n    /**\n     * When `true` (default), emit the sort order as a boolean\n     * (`order:\"asc\"` → `true`). When `false`, emit the literal `\"asc\"`/`\"desc\"`.\n     */\n    sortOrderAsBoolean?: boolean;\n    /** HTTP method used by {@link DataProvider.update}. Default: `\"patch\"`. */\n    updateMethod?: \"patch\" | \"put\";\n    /**\n     * Build the request path for a resource (and optional id).\n     * Default: `id == null ? \"/\" + resource : \"/\" + resource + \"/\" + id`.\n     */\n    buildPath?: (resource: string, id?: string | number) => string;\n}\n\nconst defaultBuildPath = (resource: string, id?: string | number): string =>\n    id == null ? `/${resource}` : `/${resource}/${id}`;\n\n/**\n * Create a {@link DataProvider} bound to an {@link ApiClient}.\n *\n * Maps Refine-style calls to the Tempest FastAPI SDK conventions: list →\n * `GET /{resource}?page=&size=&order_by=&ascending=&...filters`, one →\n * `GET /{resource}/{id}`, create → `POST`, update → `PATCH`/`PUT`,\n * delete → `DELETE`.\n *\n * @param client - The HTTP client created by `createApiClient`.\n * @param options - Optional overrides for param names, sort encoding,\n *   update method and path building.\n * @returns A stateless data provider.\n *\n * @example\n * const dataProvider = createDataProvider(apiClient);\n * const page = await dataProvider.getList<User>(\"users\", {\n *     pagination: { page: 1, pageSize: 20 },\n *     sort: { field: \"created_at\", order: \"desc\" },\n *     filters: { active: true },\n * });\n */\nexport function createDataProvider(\n    client: ApiClient,\n    options: DataProviderOptions = {},\n): DataProvider {\n    const {\n        pageParam = \"page\",\n        sizeParam = \"size\",\n        sortFieldParam = \"order_by\",\n        sortOrderParam = \"ascending\",\n        sortOrderAsBoolean = true,\n        updateMethod = \"patch\",\n        buildPath = defaultBuildPath,\n    } = options;\n\n    const provider: DataProvider = {\n        getList<T>(resource: string, params: GetListParams = {}): Promise<OffsetPage<T>> {\n            const { pagination, sort, filters } = params;\n            const query: Record<string, ParamValue> = {};\n\n            if (pagination?.page != null) query[pageParam] = pagination.page;\n            if (pagination?.pageSize != null) query[sizeParam] = pagination.pageSize;\n\n            if (sort?.field) {\n                const order = sort.order ?? \"asc\";\n                query[sortFieldParam] = sort.field;\n                query[sortOrderParam] = sortOrderAsBoolean ? order === \"asc\" : order;\n            }\n\n            if (filters) {\n                for (const [key, value] of Object.entries(filters)) {\n                    query[key] = value;\n                }\n            }\n\n            const requestOptions: RequestOptions = { params: query };\n            return client.get<OffsetPage<T>>(buildPath(resource), requestOptions);\n        },\n\n        getOne<T>(resource: string, id: string | number): Promise<T> {\n            return client.get<T>(buildPath(resource, id));\n        },\n\n        getMany<T>(resource: string, ids: (string | number)[]): Promise<T[]> {\n            return Promise.all(ids.map((id) => provider.getOne<T>(resource, id)));\n        },\n\n        create<T>(resource: string, data: unknown): Promise<T> {\n            return client.post<T>(buildPath(resource), { body: data });\n        },\n\n        update<T>(resource: string, id: string | number, data: unknown): Promise<T> {\n            const path = buildPath(resource, id);\n            return updateMethod === \"put\"\n                ? client.put<T>(path, { body: data })\n                : client.patch<T>(path, { body: data });\n        },\n\n        deleteOne<T>(resource: string, id: string | number): Promise<T> {\n            return client.delete<T>(buildPath(resource, id));\n        },\n    };\n\n    return provider;\n}\n"],"mappings":"AAmGA,IAAM,GAAoB,EAAkB,IACxC,GAAM,KAAO,IAAI,IAAa,IAAI,EAAS,GAAG,IAuBlD,SAAgB,EACZ,EACA,EAA+B,CAAC,EACpB,CACZ,GAAM,CACF,YAAY,OACZ,YAAY,OACZ,iBAAiB,WACjB,iBAAiB,YACjB,qBAAqB,GACrB,eAAe,QACf,YAAY,GACZ,EAEE,EAAyB,CAC3B,QAAW,EAAkB,EAAwB,CAAC,EAA2B,CAC7E,GAAM,CAAE,aAAY,OAAM,WAAY,EAChC,EAAoC,CAAC,EAK3C,GAHI,GAAY,MAAQ,OAAM,EAAM,GAAa,EAAW,MACxD,GAAY,UAAY,OAAM,EAAM,GAAa,EAAW,UAE5D,GAAM,MAAO,CACb,IAAM,EAAQ,EAAK,OAAS,MAC5B,EAAM,GAAkB,EAAK,MAC7B,EAAM,GAAkB,EAAqB,IAAU,MAAQ,CACnE,CAEA,GAAI,EACA,IAAK,GAAM,CAAC,EAAK,KAAU,OAAO,QAAQ,CAAO,EAC7C,EAAM,GAAO,EAIrB,IAAM,EAAiC,CAAE,OAAQ,CAAM,EACvD,OAAO,EAAO,IAAmB,EAAU,CAAQ,EAAG,CAAc,CACxE,EAEA,OAAU,EAAkB,EAAiC,CACzD,OAAO,EAAO,IAAO,EAAU,EAAU,CAAE,CAAC,CAChD,EAEA,QAAW,EAAkB,EAAwC,CACjE,OAAO,QAAQ,IAAI,EAAI,IAAK,GAAO,EAAS,OAAU,EAAU,CAAE,CAAC,CAAC,CACxE,EAEA,OAAU,EAAkB,EAA2B,CACnD,OAAO,EAAO,KAAQ,EAAU,CAAQ,EAAG,CAAE,KAAM,CAAK,CAAC,CAC7D,EAEA,OAAU,EAAkB,EAAqB,EAA2B,CACxE,IAAM,EAAO,EAAU,EAAU,CAAE,EACnC,OAAO,IAAiB,MAClB,EAAO,IAAO,EAAM,CAAE,KAAM,CAAK,CAAC,EAClC,EAAO,MAAS,EAAM,CAAE,KAAM,CAAK,CAAC,CAC9C,EAEA,UAAa,EAAkB,EAAiC,CAC5D,OAAO,EAAO,OAAU,EAAU,EAAU,CAAE,CAAC,CACnD,CACJ,EAEA,OAAO,CACX"}
+{"version":3,"file":"create-data-provider.cjs","names":[],"sources":["../../src/data/create-data-provider.ts"],"sourcesContent":["import type { ApiClient, RequestOptions } from \"@/http/types\";\nimport type { OffsetPage } from \"@/query/pagination\";\n\n/** Query-param values accepted by the API client for a list request. */\ntype ParamValue = string | number | boolean | undefined | null;\n\n/** Filters passed to {@link DataProvider.getList}, spread verbatim into the query string. */\nexport type DataFilters = Record<string, ParamValue>;\n\n/** Parameters for a paginated, sorted, filtered list request. */\nexport interface GetListParams {\n    /** Offset pagination — 1-based `page` and `pageSize`. */\n    pagination?: { page?: number; pageSize?: number };\n    /** Single-field sort. `order` defaults to `\"asc\"`. */\n    sort?: { field: string; order?: \"asc\" | \"desc\" };\n    /** Arbitrary filter query params, spread onto the request. */\n    filters?: DataFilters;\n}\n\n/**\n * Refine-style data provider over the Tempest FastAPI SDK CRUD/pagination\n * conventions. Implementations are stateless wrappers around an {@link ApiClient}.\n */\nexport interface DataProvider {\n    /**\n     * Fetch a paginated list of a resource.\n     *\n     * @param resource - The resource name (e.g. `\"users\"`).\n     * @param params - Pagination, sort and filter parameters.\n     * @returns The offset-paginated envelope.\n     */\n    getList<T>(resource: string, params?: GetListParams): Promise<OffsetPage<T>>;\n    /**\n     * Fetch a single record by id.\n     *\n     * @param resource - The resource name.\n     * @param id - The record id.\n     * @returns The record.\n     */\n    getOne<T>(resource: string, id: string | number): Promise<T>;\n    /**\n     * Fetch many records by id (default: parallel {@link DataProvider.getOne}).\n     *\n     * @param resource - The resource name.\n     * @param ids - The record ids.\n     * @returns The records, in the same order as `ids`.\n     */\n    getMany<T>(resource: string, ids: (string | number)[]): Promise<T[]>;\n    /**\n     * Create a record.\n     *\n     * @param resource - The resource name.\n     * @param data - The creation payload.\n     * @returns The created record.\n     */\n    create<T>(resource: string, data: unknown): Promise<T>;\n    /**\n     * Update a record (PATCH by default, PUT when configured).\n     *\n     * @param resource - The resource name.\n     * @param id - The record id.\n     * @param data - The update payload.\n     * @returns The updated record.\n     */\n    update<T>(resource: string, id: string | number, data: unknown): Promise<T>;\n    /**\n     * Delete a record by id.\n     *\n     * @param resource - The resource name.\n     * @param id - The record id.\n     * @returns The delete response (often the deleted record).\n     */\n    deleteOne<T>(resource: string, id: string | number): Promise<T>;\n}\n\n/** Options to tailor {@link createDataProvider} to a backend's conventions. */\nexport interface DataProviderOptions {\n    /** Query-param name for the page number. Default: `\"page\"`. */\n    pageParam?: string;\n    /** Query-param name for the page size. Default: `\"size\"`. */\n    sizeParam?: string;\n    /** Query-param name for the sort field. Default: `\"order_by\"`. */\n    sortFieldParam?: string;\n    /** Query-param name for the sort order. Default: `\"ascending\"`. */\n    sortOrderParam?: string;\n    /**\n     * When `true` (default), emit the sort order as a boolean\n     * (`order:\"asc\"` → `true`). When `false`, emit the literal `\"asc\"`/`\"desc\"`.\n     */\n    sortOrderAsBoolean?: boolean;\n    /** HTTP method used by {@link DataProvider.update}. Default: `\"patch\"`. */\n    updateMethod?: \"patch\" | \"put\";\n    /**\n     * Build the request path for a resource (and optional id).\n     * Default: `id == null ? \"/\" + resource : \"/\" + resource + \"/\" + id`.\n     *\n     * Since 0.77.0 `id` arrives already passed through {@link encodeIdSegment}:\n     * percent-encoded as one path segment, and never `\"\"`, `\".\"` or `\"..\"`. An\n     * override therefore interpolates it as-is — encoding it again would turn\n     * `%2F` into `%252F`.\n     */\n    buildPath?: (resource: string, id?: string | number) => string;\n}\n\nconst DOT_SEGMENTS: ReadonlySet<string> = new Set([\"\", \".\", \"..\"]);\n\n/**\n * Encode a record id as exactly one URL path segment.\n *\n * The data provider calls this on every id before building a path, because the\n * id is the one part of the URL that may come from outside the app — a search\n * param, a hash, a decoded route param, a value another user stored. Left raw,\n * `\"../../admin/users\"` walks the authenticated request out of the resource,\n * `\"7?role=admin\"` injects query params and `\"7#x\"` truncates the path, all\n * while the request still carries the bearer token (#438).\n *\n * `encodeURIComponent` neutralises `/`, `?`, `#` and `%`. It leaves `.` alone,\n * so `\"\"`, `\".\"` and `\"..\"` are rejected instead: the URL parser resolves them\n * as dot-segments whatever the encoding, and none of them names a record.\n * `null` and `undefined` — what an untyped caller or a not-yet-loaded route\n * param hands over — are rejected too, since `String()` would turn them into\n * the literal segments `\"null\"` and `\"undefined\"`.\n *\n * @param id - The record id, as handed to the provider.\n * @returns The percent-encoded segment, safe to interpolate between two `/`.\n * @throws {TypeError} When the id is `null`, `undefined`, `\"\"`, `\".\"` or `\"..\"`.\n *\n * @example\n * encodeIdSegment(7); // \"7\"\n * encodeIdSegment(\"a/b?x=1\"); // \"a%2Fb%3Fx%3D1\"\n * encodeIdSegment(\"..\"); // throws TypeError\n */\nexport function encodeIdSegment(id: string | number): string {\n    if (id == null) {\n        throw new TypeError(`Invalid record id ${String(id)}: a record id is required.`);\n    }\n    const raw = String(id);\n    if (DOT_SEGMENTS.has(raw)) {\n        throw new TypeError(\n            `Invalid record id ${JSON.stringify(raw)}: it would resolve as a path dot-segment.`,\n        );\n    }\n    return encodeURIComponent(raw);\n}\n\nconst defaultBuildPath = (resource: string, id?: string | number): string =>\n    id == null ? `/${resource}` : `/${resource}/${id}`;\n\n/**\n * Create a {@link DataProvider} bound to an {@link ApiClient}.\n *\n * Maps Refine-style calls to the Tempest FastAPI SDK conventions: list →\n * `GET /{resource}?page=&size=&order_by=&ascending=&...filters`, one →\n * `GET /{resource}/{id}`, create → `POST`, update → `PATCH`/`PUT`,\n * delete → `DELETE`.\n *\n * Every id goes through {@link encodeIdSegment} before reaching `buildPath`, so\n * an id can never leave its own path segment — not with the default builder,\n * and not with an override that interpolates it.\n *\n * @param client - The HTTP client created by `createApiClient`.\n * @param options - Optional overrides for param names, sort encoding,\n *   update method and path building.\n * @returns A stateless data provider.\n *\n * @example\n * const dataProvider = createDataProvider(apiClient);\n * const page = await dataProvider.getList<User>(\"users\", {\n *     pagination: { page: 1, pageSize: 20 },\n *     sort: { field: \"created_at\", order: \"desc\" },\n *     filters: { active: true },\n * });\n */\nexport function createDataProvider(\n    client: ApiClient,\n    options: DataProviderOptions = {},\n): DataProvider {\n    const {\n        pageParam = \"page\",\n        sizeParam = \"size\",\n        sortFieldParam = \"order_by\",\n        sortOrderParam = \"ascending\",\n        sortOrderAsBoolean = true,\n        updateMethod = \"patch\",\n        buildPath = defaultBuildPath,\n    } = options;\n\n    const provider: DataProvider = {\n        getList<T>(resource: string, params: GetListParams = {}): Promise<OffsetPage<T>> {\n            const { pagination, sort, filters } = params;\n            const query: Record<string, ParamValue> = {};\n\n            if (pagination?.page != null) query[pageParam] = pagination.page;\n            if (pagination?.pageSize != null) query[sizeParam] = pagination.pageSize;\n\n            if (sort?.field) {\n                const order = sort.order ?? \"asc\";\n                query[sortFieldParam] = sort.field;\n                query[sortOrderParam] = sortOrderAsBoolean ? order === \"asc\" : order;\n            }\n\n            if (filters) {\n                for (const [key, value] of Object.entries(filters)) {\n                    query[key] = value;\n                }\n            }\n\n            const requestOptions: RequestOptions = { params: query };\n            return client.get<OffsetPage<T>>(buildPath(resource), requestOptions);\n        },\n\n        async getOne<T>(resource: string, id: string | number): Promise<T> {\n            return client.get<T>(buildPath(resource, encodeIdSegment(id)));\n        },\n\n        getMany<T>(resource: string, ids: (string | number)[]): Promise<T[]> {\n            return Promise.all(ids.map((id) => provider.getOne<T>(resource, id)));\n        },\n\n        create<T>(resource: string, data: unknown): Promise<T> {\n            return client.post<T>(buildPath(resource), { body: data });\n        },\n\n        async update<T>(resource: string, id: string | number, data: unknown): Promise<T> {\n            const path = buildPath(resource, encodeIdSegment(id));\n            return updateMethod === \"put\"\n                ? client.put<T>(path, { body: data })\n                : client.patch<T>(path, { body: data });\n        },\n\n        async deleteOne<T>(resource: string, id: string | number): Promise<T> {\n            return client.delete<T>(buildPath(resource, encodeIdSegment(id)));\n        },\n    };\n\n    return provider;\n}\n"],"mappings":"AAwGA,IAAM,EAAoC,IAAI,IAAI,CAAC,GAAI,IAAK,IAAI,CAAC,EA4BjE,SAAgB,EAAgB,EAA6B,CACzD,GAAI,GAAM,KACN,MAAU,UAAU,qBAAqB,OAAO,CAAE,EAAE,2BAA2B,EAEnF,IAAM,EAAM,OAAO,CAAE,EACrB,GAAI,EAAa,IAAI,CAAG,EACpB,MAAU,UACN,qBAAqB,KAAK,UAAU,CAAG,EAAE,0CAC7C,EAEJ,OAAO,mBAAmB,CAAG,CACjC,CAEA,IAAM,GAAoB,EAAkB,IACxC,GAAM,KAAO,IAAI,IAAa,IAAI,EAAS,GAAG,IA2BlD,SAAgB,EACZ,EACA,EAA+B,CAAC,EACpB,CACZ,GAAM,CACF,YAAY,OACZ,YAAY,OACZ,iBAAiB,WACjB,iBAAiB,YACjB,qBAAqB,GACrB,eAAe,QACf,YAAY,GACZ,EAEE,EAAyB,CAC3B,QAAW,EAAkB,EAAwB,CAAC,EAA2B,CAC7E,GAAM,CAAE,aAAY,OAAM,WAAY,EAChC,EAAoC,CAAC,EAK3C,GAHI,GAAY,MAAQ,OAAM,EAAM,GAAa,EAAW,MACxD,GAAY,UAAY,OAAM,EAAM,GAAa,EAAW,UAE5D,GAAM,MAAO,CACb,IAAM,EAAQ,EAAK,OAAS,MAC5B,EAAM,GAAkB,EAAK,MAC7B,EAAM,GAAkB,EAAqB,IAAU,MAAQ,CACnE,CAEA,GAAI,EACA,IAAK,GAAM,CAAC,EAAK,KAAU,OAAO,QAAQ,CAAO,EAC7C,EAAM,GAAO,EAIrB,IAAM,EAAiC,CAAE,OAAQ,CAAM,EACvD,OAAO,EAAO,IAAmB,EAAU,CAAQ,EAAG,CAAc,CACxE,EAEA,MAAM,OAAU,EAAkB,EAAiC,CAC/D,OAAO,EAAO,IAAO,EAAU,EAAU,EAAgB,CAAE,CAAC,CAAC,CACjE,EAEA,QAAW,EAAkB,EAAwC,CACjE,OAAO,QAAQ,IAAI,EAAI,IAAK,GAAO,EAAS,OAAU,EAAU,CAAE,CAAC,CAAC,CACxE,EAEA,OAAU,EAAkB,EAA2B,CACnD,OAAO,EAAO,KAAQ,EAAU,CAAQ,EAAG,CAAE,KAAM,CAAK,CAAC,CAC7D,EAEA,MAAM,OAAU,EAAkB,EAAqB,EAA2B,CAC9E,IAAM,EAAO,EAAU,EAAU,EAAgB,CAAE,CAAC,EACpD,OAAO,IAAiB,MAClB,EAAO,IAAO,EAAM,CAAE,KAAM,CAAK,CAAC,EAClC,EAAO,MAAS,EAAM,CAAE,KAAM,CAAK,CAAC,CAC9C,EAEA,MAAM,UAAa,EAAkB,EAAiC,CAClE,OAAO,EAAO,OAAU,EAAU,EAAU,EAAgB,CAAE,CAAC,CAAC,CACpE,CACJ,EAEA,OAAO,CACX"}

package/dist/data/create-data-provider.js

@@ -1,37 +1,48 @@
 //#region src/data/create-data-provider.ts
-var e = (e, t) => t == null ? `/${e}` : `/${e}/${t}`;
-function t(t, n = {}) {
-	let { pageParam: r = "page", sizeParam: i = "size", sortFieldParam: a = "order_by", sortOrderParam: o = "ascending", sortOrderAsBoolean: s = !0, updateMethod: c = "patch", buildPath: l = e } = n, u = {
-		getList(e, n = {}) {
-			let { pagination: c, sort: u, filters: d } = n, f = {};
-			if (c?.page != null && (f[r] = c.page), c?.pageSize != null && (f[i] = c.pageSize), u?.field) {
-				let e = u.order ?? "asc";
-				f[a] = u.field, f[o] = s ? e === "asc" : e;
+var e = /* @__PURE__ */ new Set([
+	"",
+	".",
+	".."
+]);
+function t(t) {
+	if (t == null) throw TypeError(`Invalid record id ${String(t)}: a record id is required.`);
+	let n = String(t);
+	if (e.has(n)) throw TypeError(`Invalid record id ${JSON.stringify(n)}: it would resolve as a path dot-segment.`);
+	return encodeURIComponent(n);
+}
+var n = (e, t) => t == null ? `/${e}` : `/${e}/${t}`;
+function r(e, r = {}) {
+	let { pageParam: i = "page", sizeParam: a = "size", sortFieldParam: o = "order_by", sortOrderParam: s = "ascending", sortOrderAsBoolean: c = !0, updateMethod: l = "patch", buildPath: u = n } = r, d = {
+		getList(t, n = {}) {
+			let { pagination: r, sort: l, filters: d } = n, f = {};
+			if (r?.page != null && (f[i] = r.page), r?.pageSize != null && (f[a] = r.pageSize), l?.field) {
+				let e = l.order ?? "asc";
+				f[o] = l.field, f[s] = c ? e === "asc" : e;
 			}
 			if (d) for (let [e, t] of Object.entries(d)) f[e] = t;
 			let p = { params: f };
-			return t.get(l(e), p);
+			return e.get(u(t), p);
 		},
-		getOne(e, n) {
-			return t.get(l(e, n));
+		async getOne(n, r) {
+			return e.get(u(n, t(r)));
 		},
 		getMany(e, t) {
-			return Promise.all(t.map((t) => u.getOne(e, t)));
+			return Promise.all(t.map((t) => d.getOne(e, t)));
 		},
-		create(e, n) {
-			return t.post(l(e), { body: n });
+		create(t, n) {
+			return e.post(u(t), { body: n });
 		},
-		update(e, n, r) {
-			let i = l(e, n);
-			return c === "put" ? t.put(i, { body: r }) : t.patch(i, { body: r });
+		async update(n, r, i) {
+			let a = u(n, t(r));
+			return l === "put" ? e.put(a, { body: i }) : e.patch(a, { body: i });
 		},
-		deleteOne(e, n) {
-			return t.delete(l(e, n));
+		async deleteOne(n, r) {
+			return e.delete(u(n, t(r)));
 		}
 	};
-	return u;
+	return d;
 }
 //#endregion
-export { t as createDataProvider };
+export { r as createDataProvider, t as encodeIdSegment };
 
 //# sourceMappingURL=create-data-provider.js.map

package/dist/data/create-data-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-data-provider.js","names":[],"sources":["../../src/data/create-data-provider.ts"],"sourcesContent":["import type { ApiClient, RequestOptions } from \"@/http/types\";\nimport type { OffsetPage } from \"@/query/pagination\";\n\n/** Query-param values accepted by the API client for a list request. */\ntype ParamValue = string | number | boolean | undefined | null;\n\n/** Filters passed to {@link DataProvider.getList}, spread verbatim into the query string. */\nexport type DataFilters = Record<string, ParamValue>;\n\n/** Parameters for a paginated, sorted, filtered list request. */\nexport interface GetListParams {\n    /** Offset pagination — 1-based `page` and `pageSize`. */\n    pagination?: { page?: number; pageSize?: number };\n    /** Single-field sort. `order` defaults to `\"asc\"`. */\n    sort?: { field: string; order?: \"asc\" | \"desc\" };\n    /** Arbitrary filter query params, spread onto the request. */\n    filters?: DataFilters;\n}\n\n/**\n * Refine-style data provider over the Tempest FastAPI SDK CRUD/pagination\n * conventions. Implementations are stateless wrappers around an {@link ApiClient}.\n */\nexport interface DataProvider {\n    /**\n     * Fetch a paginated list of a resource.\n     *\n     * @param resource - The resource name (e.g. `\"users\"`).\n     * @param params - Pagination, sort and filter parameters.\n     * @returns The offset-paginated envelope.\n     */\n    getList<T>(resource: string, params?: GetListParams): Promise<OffsetPage<T>>;\n    /**\n     * Fetch a single record by id.\n     *\n     * @param resource - The resource name.\n     * @param id - The record id.\n     * @returns The record.\n     */\n    getOne<T>(resource: string, id: string | number): Promise<T>;\n    /**\n     * Fetch many records by id (default: parallel {@link DataProvider.getOne}).\n     *\n     * @param resource - The resource name.\n     * @param ids - The record ids.\n     * @returns The records, in the same order as `ids`.\n     */\n    getMany<T>(resource: string, ids: (string | number)[]): Promise<T[]>;\n    /**\n     * Create a record.\n     *\n     * @param resource - The resource name.\n     * @param data - The creation payload.\n     * @returns The created record.\n     */\n    create<T>(resource: string, data: unknown): Promise<T>;\n    /**\n     * Update a record (PATCH by default, PUT when configured).\n     *\n     * @param resource - The resource name.\n     * @param id - The record id.\n     * @param data - The update payload.\n     * @returns The updated record.\n     */\n    update<T>(resource: string, id: string | number, data: unknown): Promise<T>;\n    /**\n     * Delete a record by id.\n     *\n     * @param resource - The resource name.\n     * @param id - The record id.\n     * @returns The delete response (often the deleted record).\n     */\n    deleteOne<T>(resource: string, id: string | number): Promise<T>;\n}\n\n/** Options to tailor {@link createDataProvider} to a backend's conventions. */\nexport interface DataProviderOptions {\n    /** Query-param name for the page number. Default: `\"page\"`. */\n    pageParam?: string;\n    /** Query-param name for the page size. Default: `\"size\"`. */\n    sizeParam?: string;\n    /** Query-param name for the sort field. Default: `\"order_by\"`. */\n    sortFieldParam?: string;\n    /** Query-param name for the sort order. Default: `\"ascending\"`. */\n    sortOrderParam?: string;\n    /**\n     * When `true` (default), emit the sort order as a boolean\n     * (`order:\"asc\"` → `true`). When `false`, emit the literal `\"asc\"`/`\"desc\"`.\n     */\n    sortOrderAsBoolean?: boolean;\n    /** HTTP method used by {@link DataProvider.update}. Default: `\"patch\"`. */\n    updateMethod?: \"patch\" | \"put\";\n    /**\n     * Build the request path for a resource (and optional id).\n     * Default: `id == null ? \"/\" + resource : \"/\" + resource + \"/\" + id`.\n     */\n    buildPath?: (resource: string, id?: string | number) => string;\n}\n\nconst defaultBuildPath = (resource: string, id?: string | number): string =>\n    id == null ? `/${resource}` : `/${resource}/${id}`;\n\n/**\n * Create a {@link DataProvider} bound to an {@link ApiClient}.\n *\n * Maps Refine-style calls to the Tempest FastAPI SDK conventions: list →\n * `GET /{resource}?page=&size=&order_by=&ascending=&...filters`, one →\n * `GET /{resource}/{id}`, create → `POST`, update → `PATCH`/`PUT`,\n * delete → `DELETE`.\n *\n * @param client - The HTTP client created by `createApiClient`.\n * @param options - Optional overrides for param names, sort encoding,\n *   update method and path building.\n * @returns A stateless data provider.\n *\n * @example\n * const dataProvider = createDataProvider(apiClient);\n * const page = await dataProvider.getList<User>(\"users\", {\n *     pagination: { page: 1, pageSize: 20 },\n *     sort: { field: \"created_at\", order: \"desc\" },\n *     filters: { active: true },\n * });\n */\nexport function createDataProvider(\n    client: ApiClient,\n    options: DataProviderOptions = {},\n): DataProvider {\n    const {\n        pageParam = \"page\",\n        sizeParam = \"size\",\n        sortFieldParam = \"order_by\",\n        sortOrderParam = \"ascending\",\n        sortOrderAsBoolean = true,\n        updateMethod = \"patch\",\n        buildPath = defaultBuildPath,\n    } = options;\n\n    const provider: DataProvider = {\n        getList<T>(resource: string, params: GetListParams = {}): Promise<OffsetPage<T>> {\n            const { pagination, sort, filters } = params;\n            const query: Record<string, ParamValue> = {};\n\n            if (pagination?.page != null) query[pageParam] = pagination.page;\n            if (pagination?.pageSize != null) query[sizeParam] = pagination.pageSize;\n\n            if (sort?.field) {\n                const order = sort.order ?? \"asc\";\n                query[sortFieldParam] = sort.field;\n                query[sortOrderParam] = sortOrderAsBoolean ? order === \"asc\" : order;\n            }\n\n            if (filters) {\n                for (const [key, value] of Object.entries(filters)) {\n                    query[key] = value;\n                }\n            }\n\n            const requestOptions: RequestOptions = { params: query };\n            return client.get<OffsetPage<T>>(buildPath(resource), requestOptions);\n        },\n\n        getOne<T>(resource: string, id: string | number): Promise<T> {\n            return client.get<T>(buildPath(resource, id));\n        },\n\n        getMany<T>(resource: string, ids: (string | number)[]): Promise<T[]> {\n            return Promise.all(ids.map((id) => provider.getOne<T>(resource, id)));\n        },\n\n        create<T>(resource: string, data: unknown): Promise<T> {\n            return client.post<T>(buildPath(resource), { body: data });\n        },\n\n        update<T>(resource: string, id: string | number, data: unknown): Promise<T> {\n            const path = buildPath(resource, id);\n            return updateMethod === \"put\"\n                ? client.put<T>(path, { body: data })\n                : client.patch<T>(path, { body: data });\n        },\n\n        deleteOne<T>(resource: string, id: string | number): Promise<T> {\n            return client.delete<T>(buildPath(resource, id));\n        },\n    };\n\n    return provider;\n}\n"],"mappings":";AAmGA,IAAM,KAAoB,GAAkB,MACxC,KAAM,OAAO,IAAI,MAAa,IAAI,EAAS,GAAG;AAuBlD,SAAgB,EACZ,GACA,IAA+B,CAAC,GACpB;CACZ,IAAM,EACF,eAAY,QACZ,eAAY,QACZ,oBAAiB,YACjB,oBAAiB,aACjB,wBAAqB,IACrB,kBAAe,SACf,eAAY,MACZ,GAEE,IAAyB;EAC3B,QAAW,GAAkB,IAAwB,CAAC,GAA2B;GAC7E,IAAM,EAAE,eAAY,SAAM,eAAY,GAChC,IAAoC,CAAC;GAK3C,IAHI,GAAY,QAAQ,SAAM,EAAM,KAAa,EAAW,OACxD,GAAY,YAAY,SAAM,EAAM,KAAa,EAAW,WAE5D,GAAM,OAAO;IACb,IAAM,IAAQ,EAAK,SAAS;IAE5B,AADA,EAAM,KAAkB,EAAK,OAC7B,EAAM,KAAkB,IAAqB,MAAU,QAAQ;GACnE;GAEA,IAAI,GACA,KAAK,IAAM,CAAC,GAAK,MAAU,OAAO,QAAQ,CAAO,GAC7C,EAAM,KAAO;GAIrB,IAAM,IAAiC,EAAE,QAAQ,EAAM;GACvD,OAAO,EAAO,IAAmB,EAAU,CAAQ,GAAG,CAAc;EACxE;EAEA,OAAU,GAAkB,GAAiC;GACzD,OAAO,EAAO,IAAO,EAAU,GAAU,CAAE,CAAC;EAChD;EAEA,QAAW,GAAkB,GAAwC;GACjE,OAAO,QAAQ,IAAI,EAAI,KAAK,MAAO,EAAS,OAAU,GAAU,CAAE,CAAC,CAAC;EACxE;EAEA,OAAU,GAAkB,GAA2B;GACnD,OAAO,EAAO,KAAQ,EAAU,CAAQ,GAAG,EAAE,MAAM,EAAK,CAAC;EAC7D;EAEA,OAAU,GAAkB,GAAqB,GAA2B;GACxE,IAAM,IAAO,EAAU,GAAU,CAAE;GACnC,OAAO,MAAiB,QAClB,EAAO,IAAO,GAAM,EAAE,MAAM,EAAK,CAAC,IAClC,EAAO,MAAS,GAAM,EAAE,MAAM,EAAK,CAAC;EAC9C;EAEA,UAAa,GAAkB,GAAiC;GAC5D,OAAO,EAAO,OAAU,EAAU,GAAU,CAAE,CAAC;EACnD;CACJ;CAEA,OAAO;AACX"}
+{"version":3,"file":"create-data-provider.js","names":[],"sources":["../../src/data/create-data-provider.ts"],"sourcesContent":["import type { ApiClient, RequestOptions } from \"@/http/types\";\nimport type { OffsetPage } from \"@/query/pagination\";\n\n/** Query-param values accepted by the API client for a list request. */\ntype ParamValue = string | number | boolean | undefined | null;\n\n/** Filters passed to {@link DataProvider.getList}, spread verbatim into the query string. */\nexport type DataFilters = Record<string, ParamValue>;\n\n/** Parameters for a paginated, sorted, filtered list request. */\nexport interface GetListParams {\n    /** Offset pagination — 1-based `page` and `pageSize`. */\n    pagination?: { page?: number; pageSize?: number };\n    /** Single-field sort. `order` defaults to `\"asc\"`. */\n    sort?: { field: string; order?: \"asc\" | \"desc\" };\n    /** Arbitrary filter query params, spread onto the request. */\n    filters?: DataFilters;\n}\n\n/**\n * Refine-style data provider over the Tempest FastAPI SDK CRUD/pagination\n * conventions. Implementations are stateless wrappers around an {@link ApiClient}.\n */\nexport interface DataProvider {\n    /**\n     * Fetch a paginated list of a resource.\n     *\n     * @param resource - The resource name (e.g. `\"users\"`).\n     * @param params - Pagination, sort and filter parameters.\n     * @returns The offset-paginated envelope.\n     */\n    getList<T>(resource: string, params?: GetListParams): Promise<OffsetPage<T>>;\n    /**\n     * Fetch a single record by id.\n     *\n     * @param resource - The resource name.\n     * @param id - The record id.\n     * @returns The record.\n     */\n    getOne<T>(resource: string, id: string | number): Promise<T>;\n    /**\n     * Fetch many records by id (default: parallel {@link DataProvider.getOne}).\n     *\n     * @param resource - The resource name.\n     * @param ids - The record ids.\n     * @returns The records, in the same order as `ids`.\n     */\n    getMany<T>(resource: string, ids: (string | number)[]): Promise<T[]>;\n    /**\n     * Create a record.\n     *\n     * @param resource - The resource name.\n     * @param data - The creation payload.\n     * @returns The created record.\n     */\n    create<T>(resource: string, data: unknown): Promise<T>;\n    /**\n     * Update a record (PATCH by default, PUT when configured).\n     *\n     * @param resource - The resource name.\n     * @param id - The record id.\n     * @param data - The update payload.\n     * @returns The updated record.\n     */\n    update<T>(resource: string, id: string | number, data: unknown): Promise<T>;\n    /**\n     * Delete a record by id.\n     *\n     * @param resource - The resource name.\n     * @param id - The record id.\n     * @returns The delete response (often the deleted record).\n     */\n    deleteOne<T>(resource: string, id: string | number): Promise<T>;\n}\n\n/** Options to tailor {@link createDataProvider} to a backend's conventions. */\nexport interface DataProviderOptions {\n    /** Query-param name for the page number. Default: `\"page\"`. */\n    pageParam?: string;\n    /** Query-param name for the page size. Default: `\"size\"`. */\n    sizeParam?: string;\n    /** Query-param name for the sort field. Default: `\"order_by\"`. */\n    sortFieldParam?: string;\n    /** Query-param name for the sort order. Default: `\"ascending\"`. */\n    sortOrderParam?: string;\n    /**\n     * When `true` (default), emit the sort order as a boolean\n     * (`order:\"asc\"` → `true`). When `false`, emit the literal `\"asc\"`/`\"desc\"`.\n     */\n    sortOrderAsBoolean?: boolean;\n    /** HTTP method used by {@link DataProvider.update}. Default: `\"patch\"`. */\n    updateMethod?: \"patch\" | \"put\";\n    /**\n     * Build the request path for a resource (and optional id).\n     * Default: `id == null ? \"/\" + resource : \"/\" + resource + \"/\" + id`.\n     *\n     * Since 0.77.0 `id` arrives already passed through {@link encodeIdSegment}:\n     * percent-encoded as one path segment, and never `\"\"`, `\".\"` or `\"..\"`. An\n     * override therefore interpolates it as-is — encoding it again would turn\n     * `%2F` into `%252F`.\n     */\n    buildPath?: (resource: string, id?: string | number) => string;\n}\n\nconst DOT_SEGMENTS: ReadonlySet<string> = new Set([\"\", \".\", \"..\"]);\n\n/**\n * Encode a record id as exactly one URL path segment.\n *\n * The data provider calls this on every id before building a path, because the\n * id is the one part of the URL that may come from outside the app — a search\n * param, a hash, a decoded route param, a value another user stored. Left raw,\n * `\"../../admin/users\"` walks the authenticated request out of the resource,\n * `\"7?role=admin\"` injects query params and `\"7#x\"` truncates the path, all\n * while the request still carries the bearer token (#438).\n *\n * `encodeURIComponent` neutralises `/`, `?`, `#` and `%`. It leaves `.` alone,\n * so `\"\"`, `\".\"` and `\"..\"` are rejected instead: the URL parser resolves them\n * as dot-segments whatever the encoding, and none of them names a record.\n * `null` and `undefined` — what an untyped caller or a not-yet-loaded route\n * param hands over — are rejected too, since `String()` would turn them into\n * the literal segments `\"null\"` and `\"undefined\"`.\n *\n * @param id - The record id, as handed to the provider.\n * @returns The percent-encoded segment, safe to interpolate between two `/`.\n * @throws {TypeError} When the id is `null`, `undefined`, `\"\"`, `\".\"` or `\"..\"`.\n *\n * @example\n * encodeIdSegment(7); // \"7\"\n * encodeIdSegment(\"a/b?x=1\"); // \"a%2Fb%3Fx%3D1\"\n * encodeIdSegment(\"..\"); // throws TypeError\n */\nexport function encodeIdSegment(id: string | number): string {\n    if (id == null) {\n        throw new TypeError(`Invalid record id ${String(id)}: a record id is required.`);\n    }\n    const raw = String(id);\n    if (DOT_SEGMENTS.has(raw)) {\n        throw new TypeError(\n            `Invalid record id ${JSON.stringify(raw)}: it would resolve as a path dot-segment.`,\n        );\n    }\n    return encodeURIComponent(raw);\n}\n\nconst defaultBuildPath = (resource: string, id?: string | number): string =>\n    id == null ? `/${resource}` : `/${resource}/${id}`;\n\n/**\n * Create a {@link DataProvider} bound to an {@link ApiClient}.\n *\n * Maps Refine-style calls to the Tempest FastAPI SDK conventions: list →\n * `GET /{resource}?page=&size=&order_by=&ascending=&...filters`, one →\n * `GET /{resource}/{id}`, create → `POST`, update → `PATCH`/`PUT`,\n * delete → `DELETE`.\n *\n * Every id goes through {@link encodeIdSegment} before reaching `buildPath`, so\n * an id can never leave its own path segment — not with the default builder,\n * and not with an override that interpolates it.\n *\n * @param client - The HTTP client created by `createApiClient`.\n * @param options - Optional overrides for param names, sort encoding,\n *   update method and path building.\n * @returns A stateless data provider.\n *\n * @example\n * const dataProvider = createDataProvider(apiClient);\n * const page = await dataProvider.getList<User>(\"users\", {\n *     pagination: { page: 1, pageSize: 20 },\n *     sort: { field: \"created_at\", order: \"desc\" },\n *     filters: { active: true },\n * });\n */\nexport function createDataProvider(\n    client: ApiClient,\n    options: DataProviderOptions = {},\n): DataProvider {\n    const {\n        pageParam = \"page\",\n        sizeParam = \"size\",\n        sortFieldParam = \"order_by\",\n        sortOrderParam = \"ascending\",\n        sortOrderAsBoolean = true,\n        updateMethod = \"patch\",\n        buildPath = defaultBuildPath,\n    } = options;\n\n    const provider: DataProvider = {\n        getList<T>(resource: string, params: GetListParams = {}): Promise<OffsetPage<T>> {\n            const { pagination, sort, filters } = params;\n            const query: Record<string, ParamValue> = {};\n\n            if (pagination?.page != null) query[pageParam] = pagination.page;\n            if (pagination?.pageSize != null) query[sizeParam] = pagination.pageSize;\n\n            if (sort?.field) {\n                const order = sort.order ?? \"asc\";\n                query[sortFieldParam] = sort.field;\n                query[sortOrderParam] = sortOrderAsBoolean ? order === \"asc\" : order;\n            }\n\n            if (filters) {\n                for (const [key, value] of Object.entries(filters)) {\n                    query[key] = value;\n                }\n            }\n\n            const requestOptions: RequestOptions = { params: query };\n            return client.get<OffsetPage<T>>(buildPath(resource), requestOptions);\n        },\n\n        async getOne<T>(resource: string, id: string | number): Promise<T> {\n            return client.get<T>(buildPath(resource, encodeIdSegment(id)));\n        },\n\n        getMany<T>(resource: string, ids: (string | number)[]): Promise<T[]> {\n            return Promise.all(ids.map((id) => provider.getOne<T>(resource, id)));\n        },\n\n        create<T>(resource: string, data: unknown): Promise<T> {\n            return client.post<T>(buildPath(resource), { body: data });\n        },\n\n        async update<T>(resource: string, id: string | number, data: unknown): Promise<T> {\n            const path = buildPath(resource, encodeIdSegment(id));\n            return updateMethod === \"put\"\n                ? client.put<T>(path, { body: data })\n                : client.patch<T>(path, { body: data });\n        },\n\n        async deleteOne<T>(resource: string, id: string | number): Promise<T> {\n            return client.delete<T>(buildPath(resource, encodeIdSegment(id)));\n        },\n    };\n\n    return provider;\n}\n"],"mappings":";AAwGA,IAAM,oBAAoC,IAAI,IAAI;CAAC;CAAI;CAAK;AAAI,CAAC;AA4BjE,SAAgB,EAAgB,GAA6B;CACzD,IAAI,KAAM,MACN,MAAU,UAAU,qBAAqB,OAAO,CAAE,EAAE,2BAA2B;CAEnF,IAAM,IAAM,OAAO,CAAE;CACrB,IAAI,EAAa,IAAI,CAAG,GACpB,MAAU,UACN,qBAAqB,KAAK,UAAU,CAAG,EAAE,0CAC7C;CAEJ,OAAO,mBAAmB,CAAG;AACjC;AAEA,IAAM,KAAoB,GAAkB,MACxC,KAAM,OAAO,IAAI,MAAa,IAAI,EAAS,GAAG;AA2BlD,SAAgB,EACZ,GACA,IAA+B,CAAC,GACpB;CACZ,IAAM,EACF,eAAY,QACZ,eAAY,QACZ,oBAAiB,YACjB,oBAAiB,aACjB,wBAAqB,IACrB,kBAAe,SACf,eAAY,MACZ,GAEE,IAAyB;EAC3B,QAAW,GAAkB,IAAwB,CAAC,GAA2B;GAC7E,IAAM,EAAE,eAAY,SAAM,eAAY,GAChC,IAAoC,CAAC;GAK3C,IAHI,GAAY,QAAQ,SAAM,EAAM,KAAa,EAAW,OACxD,GAAY,YAAY,SAAM,EAAM,KAAa,EAAW,WAE5D,GAAM,OAAO;IACb,IAAM,IAAQ,EAAK,SAAS;IAE5B,AADA,EAAM,KAAkB,EAAK,OAC7B,EAAM,KAAkB,IAAqB,MAAU,QAAQ;GACnE;GAEA,IAAI,GACA,KAAK,IAAM,CAAC,GAAK,MAAU,OAAO,QAAQ,CAAO,GAC7C,EAAM,KAAO;GAIrB,IAAM,IAAiC,EAAE,QAAQ,EAAM;GACvD,OAAO,EAAO,IAAmB,EAAU,CAAQ,GAAG,CAAc;EACxE;EAEA,MAAM,OAAU,GAAkB,GAAiC;GAC/D,OAAO,EAAO,IAAO,EAAU,GAAU,EAAgB,CAAE,CAAC,CAAC;EACjE;EAEA,QAAW,GAAkB,GAAwC;GACjE,OAAO,QAAQ,IAAI,EAAI,KAAK,MAAO,EAAS,OAAU,GAAU,CAAE,CAAC,CAAC;EACxE;EAEA,OAAU,GAAkB,GAA2B;GACnD,OAAO,EAAO,KAAQ,EAAU,CAAQ,GAAG,EAAE,MAAM,EAAK,CAAC;EAC7D;EAEA,MAAM,OAAU,GAAkB,GAAqB,GAA2B;GAC9E,IAAM,IAAO,EAAU,GAAU,EAAgB,CAAE,CAAC;GACpD,OAAO,MAAiB,QAClB,EAAO,IAAO,GAAM,EAAE,MAAM,EAAK,CAAC,IAClC,EAAO,MAAS,GAAM,EAAE,MAAM,EAAK,CAAC;EAC9C;EAEA,MAAM,UAAa,GAAkB,GAAiC;GAClE,OAAO,EAAO,OAAU,EAAU,GAAU,EAAgB,CAAE,CAAC,CAAC;EACpE;CACJ;CAEA,OAAO;AACX"}

package/dist/http/api-client.cjs

@@ -1,2 +1,2 @@
-const e=require("../utils/ids.cjs"),t=require("./build-url.cjs"),n=require("./credential-scope.cjs"),r=require("./csrf.cjs"),i=require("./decode-response.cjs"),a=require("./errors.cjs"),o=require("./retry.cjs"),s=require("./timeout.cjs");var c=new Set([`GET`,`HEAD`,`OPTIONS`]);function l(e,t){return!c.has(t)||!(e instanceof a.TempestApiError)?!1:a.isRetriableStatus(e.status)}function u(e){return e?e===!0?{}:e:null}var d=15e3,f=3e5;function p(e){return typeof FormData<`u`&&e instanceof FormData}function m(e){return Math.round(performance.now()-e)}async function h(e,t){let n;try{n=await e.clone().json()}catch{try{n=await e.text()}catch{n=null}}return new a.TempestApiError(a.buildApiError(e.status,n,e.headers,t))}function g(c){let g=c.fetcher??globalThis.fetch.bind(globalThis);function _(e,t){if(t)return{};let r=c.getToken?.();return r?n.isTrustedCredentialTarget(e,c.baseURL,c.trustedOrigins)?{Authorization:`Bearer ${r}`}:(n.reportSuppressedCredential(e,c.baseURL),{}):{}}async function v(e,n,i,o){let{body:l,params:u,headers:m,signal:h,timeout:v,...y}=n,b=p(l),x=b?c.uploadTimeout:c.timeout,S=v===void 0?x===void 0?b?f:d:x:v,C=t.buildApiUrl(c.baseURL,e,{prefix:c.prefix,params:u}),w=m,T={...b?{}:{"Content-Type":`application/json`},...i?{"X-Request-ID":i}:{},...c.headers,..._(C,o),...r.csrfHeaders({method:y.method??`GET`,url:C,reference:c.baseURL,csrf:c.csrf,trustedOrigins:c.trustedOrigins,headers:{...c.headers,...w}}),...w},E=s.withTimeout(h,S),D={...y,signal:E.signal,headers:T,credentials:c.withCredentials?`include`:y.credentials,body:l==null?void 0:b?l:JSON.stringify(l)};try{return await g(C,D)}catch(e){throw E.timedOut()?new a.TempestApiError({status:0,detail:`A requisição excedeu ${S}ms e foi abandonada.`}):e}finally{E.dispose()}}async function y(e,t,n,r,i){let a=c.logger;if(!a)return v(e,t,n,i);let o=performance.now();try{let s=await v(e,t,n,i),c={requestId:n,status:s.status,ms:m(o)},l=`${r} ${e} → ${s.status}`;return s.status>=400?a.warn(l,c):a.debug(l,c),s}catch(t){throw a.warn(`${r} ${e} → no response`,{requestId:n,ms:m(o),error:t}),t}}async function b(e,t){if(c.onUnauthorized){c.logger?.warn(`unauthorized — calling onUnauthorized`,{requestId:t,status:e.status});try{await c.onUnauthorized(e)}catch(n){c.logger?.warn(`onUnauthorized threw — keeping the original response error`,{requestId:t,status:e.status,error:n})}}}async function x(t,n,r){let{skipAuth:i=!1,skipAuthRetry:a=!1,...o}=n,s=c.requestId?c.requestId():e.randomId(),l=(o.method??`GET`).toUpperCase(),u=await y(t,o,s,l,i);if(u.status===401&&!i&&!a){if(c.refresh){try{await c.refresh(),u=await y(t,o,s,l,i)}catch{throw await b(u,s),await h(u,s)}u.status===401&&await b(u,s)}else await b(u,s)}if(!u.ok)throw await h(u,s);return r(u)}async function S(e,t,n){let{retry:r,...i}=t,a=u(r===void 0?c.retry:r);if(!a)return x(e,i,n);let s=(i.method??`GET`).toUpperCase();return o.retry(()=>x(e,i,n),{...a,shouldRetry:a.shouldRetry??(e=>l(e,s))})}async function C(e,t={}){return S(e,t,i.decodeByContentType)}async function w(e,t,n=`POST`,r){return C(e,{...r,method:n,body:t})}return{request:C,get:(e,t)=>C(e,{...t,method:`GET`}),post:(e,t)=>C(e,{...t,method:`POST`}),put:(e,t)=>C(e,{...t,method:`PUT`}),patch:(e,t)=>C(e,{...t,method:`PATCH`}),delete:(e,t)=>C(e,{...t,method:`DELETE`}),blob:(e,t)=>S(e,{...t},e=>e.blob()),arrayBuffer:(e,t)=>S(e,{...t},e=>e.arrayBuffer()),upload:w}}exports.createApiClient=g;
+const e=require("../utils/ids.cjs"),t=require("./build-url.cjs"),n=require("./credential-scope.cjs"),r=require("./csrf.cjs"),i=require("./decode-response.cjs"),a=require("./errors.cjs"),o=require("./retry.cjs"),s=require("./timeout.cjs");var c=new Set([`GET`,`HEAD`,`OPTIONS`]);function l(e,t){return!c.has(t)||!(e instanceof a.TempestApiError)?!1:a.isRetriableStatus(e.status)}function u(e){return e?e===!0?{}:e:null}var d=15e3,f=3e5;function p(e){return typeof FormData<`u`&&e instanceof FormData}function m(e){return Math.round(performance.now()-e)}async function h(e,t){let n;try{n=await e.clone().json()}catch{try{n=await e.text()}catch{n=null}}return new a.TempestApiError(a.buildApiError(e.status,n,e.headers,t))}function g(c){let g=c.fetcher??globalThis.fetch.bind(globalThis);function _(e,t){if(t)return{};let r=c.getToken?.();return r?n.isTrustedCredentialTarget(e,c.baseURL,c.trustedOrigins)?{Authorization:`Bearer ${r}`}:(n.reportSuppressedCredential(e,c.baseURL),{}):{}}async function v(e,n,i,o){let{body:l,params:u,headers:m,signal:h,timeout:v,...y}=n,b=p(l),x=b?c.uploadTimeout:c.timeout,S=v===void 0?x===void 0?b?f:d:x:v,C=t.buildApiUrl(c.baseURL,e,{prefix:c.prefix,params:u}),w=m,T={...b?{}:{"Content-Type":`application/json`},...i?{"X-Request-ID":i}:{},...c.headers,..._(C,o),...r.csrfHeaders({method:y.method??`GET`,url:C,reference:c.baseURL,csrf:c.csrf,trustedOrigins:c.trustedOrigins,headers:{...c.headers,...w}}),...w},E=s.withTimeout(h,S),D={...y,signal:E.signal,headers:T,credentials:c.withCredentials?`include`:y.credentials,body:l==null?void 0:b?l:JSON.stringify(l)};try{return await g(C,D)}catch(e){throw E.timedOut()?new a.TempestApiError({status:0,detail:`A requisição excedeu ${S}ms e foi abandonada.`}):e}finally{E.dispose()}}async function y(e,t,n,r,i){let a=c.logger;if(!a)return v(e,t,n,i);let o=performance.now();try{let s=await v(e,t,n,i),c={requestId:n,status:s.status,ms:m(o)},l=`${r} ${e} → ${s.status}`;return s.status>=400?a.warn(l,c):a.debug(l,c),s}catch(t){throw a.warn(`${r} ${e} → no response`,{requestId:n,ms:m(o),error:t}),t}}async function b(e,t,n){if(c.onUnauthorized){c.logger?.warn(`unauthorized — calling onUnauthorized`,{requestId:t,status:e.status});try{await c.onUnauthorized(e,n)}catch(n){if(n instanceof a.SessionSupersededError)throw n;c.logger?.warn(`onUnauthorized threw — keeping the original response error`,{requestId:t,status:e.status,error:n})}}}function x(e){return{token:e?null:c.getToken?.()??null,epoch:c.getSessionEpoch?.()??null}}async function S(t,n,r){let{skipAuth:i=!1,skipAuthRetry:o=!1,...s}=n,l=c.requestId?c.requestId():e.randomId(),u=(s.method??`GET`).toUpperCase(),d=x(i),f=await y(t,s,l,u,i);if(f.status===401&&!i&&!o){if(c.refresh){let e;try{await c.refresh(d),e=x(i),f=await y(t,s,l,u,i)}catch(e){throw e instanceof a.SessionSupersededError?e:(await b(f,l,d),await h(f,l))}f.status===401&&await b(f,l,e)}else await b(f,l,d)}if(!f.ok)throw await h(f,l);return r(f)}async function C(e,t,n){let{retry:r,...i}=t,a=u(r===void 0?c.retry:r);if(!a)return S(e,i,n);let s=(i.method??`GET`).toUpperCase();return o.retry(()=>S(e,i,n),{...a,shouldRetry:a.shouldRetry??(e=>l(e,s))})}async function w(e,t={}){return C(e,t,i.decodeByContentType)}async function T(e,t,n=`POST`,r){return w(e,{...r,method:n,body:t})}return{request:w,get:(e,t)=>w(e,{...t,method:`GET`}),post:(e,t)=>w(e,{...t,method:`POST`}),put:(e,t)=>w(e,{...t,method:`PUT`}),patch:(e,t)=>w(e,{...t,method:`PATCH`}),delete:(e,t)=>w(e,{...t,method:`DELETE`}),blob:(e,t)=>C(e,{...t},e=>e.blob()),arrayBuffer:(e,t)=>C(e,{...t},e=>e.arrayBuffer()),upload:T}}exports.createApiClient=g;
 //# sourceMappingURL=api-client.cjs.map

package/dist/http/api-client.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.cjs","names":[],"sources":["../../src/http/api-client.ts"],"sourcesContent":["/**\n * @tempest-limits function-lines — createApiClient is over the limit and every line\n * is a request-lifecycle concern the client cannot delegate: base URL joining, the\n * auth header, the 401 refresh-and-replay, the opt-in retry wrapper and the response\n * parsing that turns a failure into a typed error.\n */\nimport { randomId } from \"../utils\";\nimport { buildApiUrl } from \"./build-url\";\nimport { isTrustedCredentialTarget, reportSuppressedCredential } from \"./credential-scope\";\nimport { csrfHeaders } from \"./csrf\";\nimport { decodeByContentType } from \"./decode-response\";\nimport type { ResponseDecoder } from \"./decode-response\";\nimport { buildApiError, TempestApiError, isRetriableStatus } from \"./errors\";\nimport { retry as retryWithBackoff } from \"./retry\";\nimport type { RetryOptions } from \"./retry\";\nimport { withTimeout } from \"./timeout\";\nimport type { ApiClient, ApiClientConfig, RequestOptions } from \"./types\";\n\n/**\n * Methods the built-in retry policy will replay.\n *\n * `PUT` and `DELETE` are idempotent on paper but stay out: a backend that logs,\n * bills, or fires a webhook per call still sees two, so replaying them is a\n * decision the caller makes through `shouldRetry`, not a default.\n */\nconst IDEMPOTENT_METHODS: ReadonlySet<string> = new Set([\"GET\", \"HEAD\", \"OPTIONS\"]);\n\n/**\n * Sub-500 statuses worth a second attempt: a network failure (status `0`), a\n * request timeout, a too-early replay, and a rate limit — which usually carries\n * the `Retry-After` the backoff already honours.\n */\n\n/**\n * The built-in retry policy, used when `retry` is `true` or is options carrying\n * no `shouldRetry` of their own.\n *\n * Conservative on purpose. Replaying a write can duplicate it, and replaying a\n * `400` or a `403` cannot fix a bad payload or a permission the caller does not\n * have — it only spends the user's time before showing the same error.\n *\n * @param error - Whatever the attempt threw.\n * @param method - The upper-cased HTTP method of the request.\n * @returns Whether the client should try again.\n */\nfunction isRetriableFailure(error: unknown, method: string): boolean {\n    if (!IDEMPOTENT_METHODS.has(method)) return false;\n    if (!(error instanceof TempestApiError)) return false;\n    return isRetriableStatus(error.status);\n}\n\n/**\n * Normalize the `retry` config into options, or `null` when retrying is off.\n *\n * @param config - The `retry` field as the caller wrote it.\n * @returns Retry options to use, or `null` to run a single attempt.\n */\nfunction resolveRetry(config: boolean | RetryOptions | undefined): RetryOptions | null {\n    if (!config) return null;\n    return config === true ? {} : config;\n}\n\n/** Default milliseconds before a request is abandoned. */\nconst DEFAULT_TIMEOUT = 15_000;\n\n/** Default milliseconds before a `FormData` request is abandoned. */\nconst DEFAULT_UPLOAD_TIMEOUT = 300_000;\n\nfunction isFormData(body: unknown): body is FormData {\n    return typeof FormData !== \"undefined\" && body instanceof FormData;\n}\n\n/**\n * Milliseconds since a `performance.now()` reading, rounded.\n *\n * `performance.now()` rather than `Date.now()` because this measures a\n * duration: the wall clock can step sideways mid-request (an NTP correction, a\n * VM resuming, the user changing the clock) and turn a 40 ms call into a\n * negative number. The monotonic clock cannot.\n *\n * @param startedAt - The reading taken before the work started.\n * @returns Whole milliseconds elapsed.\n */\nfunction elapsedMs(startedAt: number): number {\n    return Math.round(performance.now() - startedAt);\n}\n\nasync function parseError(response: Response, sentRequestId?: string): Promise<TempestApiError> {\n    let body: unknown;\n    try {\n        body = await response.clone().json();\n    } catch {\n        try {\n            body = await response.text();\n        } catch {\n            body = null;\n        }\n    }\n    return new TempestApiError(\n        buildApiError(response.status, body, response.headers, sentRequestId),\n    );\n}\n\n/**\n * Create a typed HTTP client backed by `fetch`.\n *\n * Handles JSON serialization, query params, bearer auth via `getToken`, uploads\n * via `FormData`, and throws a typed `ApiError` on any non-2xx response.\n *\n * **Expired sessions.** A `401` with `refresh` configured awaits the refresh and\n * replays the request once. `onUnauthorized` fires whenever that path ends\n * unauthorized anyway — the refresh threw, or the replay came back `401` — which\n * is the signal to clear the session. Without `refresh`, the first `401` calls\n * it directly.\n *\n * **Binary bodies** have their own methods — `blob()` and `arrayBuffer()` — which\n * run the same pipeline and skip the parse. `request()` no longer decodes an\n * unknown `Content-Type` as text either: it returns a `Blob` and says so once in\n * a development build, because reading `image/jpeg` as UTF-8 destroyed the bytes\n * on the way in.\n *\n * **The bearer token is scoped to `baseURL`'s origin** since 0.66.0. A path may\n * be an absolute URL, which overrides the base entirely, so without a scope the\n * destination of a credentialed request could come from a value read off the\n * network. A request to another origin still goes out; it goes without the\n * header, and a development build says so once. Declare the exceptions in\n * {@link ApiClientConfig.trustedOrigins}.\n *\n * **CSRF** is off unless you set `csrf`. With it, every unsafe request (anything\n * but `GET`/`HEAD`/`OPTIONS`/`TRACE`) echoes the `csrf_token` cookie in an\n * `X-CSRF-Token` header — the double-submit contract of `tempest-fastapi-sdk`'s\n * `CSRFMiddleware` — scoped to the same origins as the bearer token and sent on\n * `skipAuth` requests too. See {@link ApiClientConfig.csrf}.\n *\n * **Retries** are off unless you set `retry`. See {@link ApiClientConfig.retry}\n * for the built-in policy; it never replays a write. A single call overrides it\n * with {@link RequestOptions.retry}, and opts out of auth entirely with\n * {@link RequestOptions.skipAuth}.\n *\n * **Logging** is off unless you pass a `logger`. With one, every finished attempt\n * writes a line — `debug` under 400, `warn` from 400 up, plus a `warn` when\n * `onUnauthorized` fires — carrying `requestId`, `status` and elapsed `ms`, and\n * never a body, header or query string. The level and the destination belong to\n * the logger, not to a boolean here.\n *\n * @example\n * const api = createApiClient({\n *     baseURL: import.meta.env.VITE_API_URL,\n *     getToken: () => useAuthStore.getState().token,\n *     refresh,\n *     onUnauthorized: () => useAuthStore.getState().logout(),\n *     logger: createLogger({ level: import.meta.env.DEV ? \"debug\" : \"warn\" }).child(\"http\"),\n *     retry: true,\n * });\n *\n * @param config - Base URL plus the optional auth, retry and fetch hooks.\n * @returns A client with `request`/`get`/`post`/`put`/`patch`/`delete`/`blob`/\n * `arrayBuffer`/`upload`.\n */\nexport function createApiClient(config: ApiClientConfig): ApiClient {\n    const fetcher = config.fetcher ?? globalThis.fetch.bind(globalThis);\n\n    /**\n     * The `Authorization` header for a request, or nothing.\n     *\n     * Takes the resolved URL rather than reading `config.baseURL`, because an\n     * absolute path overrides the base entirely (see `buildApiUrl`) and the\n     * credential is scoped to an origin, not to a client.\n     *\n     * @param url - The absolute URL the request is going to.\n     * @param skipAuth - Whether the caller opted this request out of auth.\n     * @returns The header, or an empty object.\n     */\n    function authHeaders(url: string, skipAuth: boolean): Record<string, string> {\n        if (skipAuth) return {};\n        const token = config.getToken?.();\n        if (!token) return {};\n        if (!isTrustedCredentialTarget(url, config.baseURL, config.trustedOrigins)) {\n            reportSuppressedCredential(url, config.baseURL);\n            return {};\n        }\n        return { Authorization: `Bearer ${token}` };\n    }\n\n    async function rawRequest(\n        path: string,\n        options: RequestOptions,\n        requestId: string | undefined,\n        skipAuth: boolean,\n    ): Promise<Response> {\n        const { body, params, headers, signal, timeout, ...rest } = options;\n        const isForm = isFormData(body);\n        const configured = isForm ? config.uploadTimeout : config.timeout;\n        const fallback = isForm ? DEFAULT_UPLOAD_TIMEOUT : DEFAULT_TIMEOUT;\n        const limit =\n            timeout !== undefined ? timeout : configured !== undefined ? configured : fallback;\n\n        const url = buildApiUrl(config.baseURL, path, { prefix: config.prefix, params });\n\n        const callerHeaders = headers as Record<string, string> | undefined;\n        const finalHeaders: Record<string, string> = {\n            ...(isForm ? {} : { \"Content-Type\": \"application/json\" }),\n            ...(requestId ? { \"X-Request-ID\": requestId } : {}),\n            ...config.headers,\n            ...authHeaders(url, skipAuth),\n            ...csrfHeaders({\n                method: rest.method ?? \"GET\",\n                url,\n                reference: config.baseURL,\n                csrf: config.csrf,\n                trustedOrigins: config.trustedOrigins,\n                headers: { ...config.headers, ...callerHeaders },\n            }),\n            ...callerHeaders,\n        };\n\n        const timed = withTimeout(signal, limit);\n        const init: RequestInit = {\n            ...rest,\n            signal: timed.signal,\n            headers: finalHeaders,\n            credentials: config.withCredentials ? \"include\" : rest.credentials,\n            body:\n                body === undefined || body === null\n                    ? undefined\n                    : isForm\n                      ? (body as FormData)\n                      : JSON.stringify(body),\n        };\n\n        try {\n            return await fetcher(url, init);\n        } catch (cause) {\n            if (timed.timedOut()) {\n                throw new TempestApiError({\n                    status: 0,\n                    detail: `A requisição excedeu ${limit}ms e foi abandonada.`,\n                });\n            }\n            throw cause;\n        } finally {\n            timed.dispose();\n        }\n    }\n\n    async function send(\n        path: string,\n        options: RequestOptions,\n        requestId: string,\n        method: string,\n        skipAuth: boolean,\n    ): Promise<Response> {\n        const log = config.logger;\n        if (!log) return rawRequest(path, options, requestId, skipAuth);\n\n        const startedAt = performance.now();\n        try {\n            const response = await rawRequest(path, options, requestId, skipAuth);\n            const entry = { requestId, status: response.status, ms: elapsedMs(startedAt) };\n            const line = `${method} ${path} → ${response.status}`;\n            if (response.status >= 400) log.warn(line, entry);\n            else log.debug(line, entry);\n            return response;\n        } catch (error) {\n            log.warn(`${method} ${path} → no response`, {\n                requestId,\n                ms: elapsedMs(startedAt),\n                error,\n            });\n            throw error;\n        }\n    }\n\n    async function notifyUnauthorized(response: Response, requestId: string): Promise<void> {\n        if (!config.onUnauthorized) return;\n        config.logger?.warn(`unauthorized — calling onUnauthorized`, {\n            requestId,\n            status: response.status,\n        });\n        try {\n            await config.onUnauthorized(response);\n        } catch (error) {\n            config.logger?.warn(`onUnauthorized threw — keeping the original response error`, {\n                requestId,\n                status: response.status,\n                error,\n            });\n        }\n    }\n\n    async function attempt<T>(\n        path: string,\n        options: RequestOptions,\n        decode: ResponseDecoder<T>,\n    ): Promise<T> {\n        const { skipAuth = false, skipAuthRetry = false, ...init } = options;\n        const requestId = config.requestId ? config.requestId() : randomId();\n        const method = (init.method ?? \"GET\").toUpperCase();\n        let response = await send(path, init, requestId, method, skipAuth);\n\n        if (response.status === 401 && !skipAuth && !skipAuthRetry) {\n            if (config.refresh) {\n                try {\n                    await config.refresh();\n                    response = await send(path, init, requestId, method, skipAuth);\n                } catch {\n                    await notifyUnauthorized(response, requestId);\n                    throw await parseError(response, requestId);\n                }\n                if (response.status === 401) {\n                    await notifyUnauthorized(response, requestId);\n                }\n            } else {\n                await notifyUnauthorized(response, requestId);\n            }\n        }\n\n        if (!response.ok) {\n            throw await parseError(response, requestId);\n        }\n\n        return decode(response);\n    }\n\n    async function run<T>(\n        path: string,\n        options: RequestOptions,\n        decode: ResponseDecoder<T>,\n    ): Promise<T> {\n        const { retry: perRequest, ...rest } = options;\n        const retryOptions = resolveRetry(perRequest !== undefined ? perRequest : config.retry);\n        if (!retryOptions) return attempt<T>(path, rest, decode);\n\n        const method = (rest.method ?? \"GET\").toUpperCase();\n        return retryWithBackoff(() => attempt<T>(path, rest, decode), {\n            ...retryOptions,\n            shouldRetry:\n                retryOptions.shouldRetry ?? ((error: unknown) => isRetriableFailure(error, method)),\n        });\n    }\n\n    async function request<T>(path: string, options: RequestOptions = {}): Promise<T> {\n        return run<T>(path, options, decodeByContentType);\n    }\n\n    async function upload<T>(\n        path: string,\n        formData: FormData,\n        method: \"POST\" | \"PUT\" | \"PATCH\" = \"POST\",\n        options?: Omit<RequestOptions, \"body\" | \"method\">,\n    ): Promise<T> {\n        return request<T>(path, { ...options, method, body: formData });\n    }\n\n    return {\n        request,\n        get: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"GET\" }),\n        post: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"POST\" }),\n        put: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"PUT\" }),\n        patch: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"PATCH\" }),\n        delete: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"DELETE\" }),\n        blob: (path: string, options?: RequestOptions) =>\n            run<Blob>(path, { ...options }, (response) => response.blob()),\n        arrayBuffer: (path: string, options?: RequestOptions) =>\n            run<ArrayBuffer>(path, { ...options }, (response) => response.arrayBuffer()),\n        upload,\n    };\n}\n"],"mappings":"8OAyBA,IAAM,EAA0C,IAAI,IAAI,CAAC,MAAO,OAAQ,SAAS,CAAC,EAoBlF,SAAS,EAAmB,EAAgB,EAAyB,CAGjE,MAFI,CAAC,EAAmB,IAAI,CAAM,GAC9B,EAAE,aAAiB,EAAA,iBAAyB,GACzC,EAAA,kBAAkB,EAAM,MAAM,CACzC,CAQA,SAAS,EAAa,EAAiE,CAEnF,OADK,EACE,IAAW,GAAO,CAAC,EAAI,EADV,IAExB,CAGA,IAAM,EAAkB,KAGlB,EAAyB,IAE/B,SAAS,EAAW,EAAiC,CACjD,OAAO,OAAO,SAAa,KAAe,aAAgB,QAC9D,CAaA,SAAS,EAAU,EAA2B,CAC1C,OAAO,KAAK,MAAM,YAAY,IAAI,EAAI,CAAS,CACnD,CAEA,eAAe,EAAW,EAAoB,EAAkD,CAC5F,IAAI,EACJ,GAAI,CACA,EAAO,MAAM,EAAS,MAAM,CAAC,CAAC,KAAK,CACvC,MAAQ,CACJ,GAAI,CACA,EAAO,MAAM,EAAS,KAAK,CAC/B,MAAQ,CACJ,EAAO,IACX,CACJ,CACA,OAAO,IAAI,EAAA,gBACP,EAAA,cAAc,EAAS,OAAQ,EAAM,EAAS,QAAS,CAAa,CACxE,CACJ,CA0DA,SAAgB,EAAgB,EAAoC,CAChE,IAAM,EAAU,EAAO,SAAW,WAAW,MAAM,KAAK,UAAU,EAalE,SAAS,EAAY,EAAa,EAA2C,CACzE,GAAI,EAAU,MAAO,CAAC,EACtB,IAAM,EAAQ,EAAO,WAAW,EAMhC,OALK,EACA,EAAA,0BAA0B,EAAK,EAAO,QAAS,EAAO,cAAc,EAIlE,CAAE,cAAe,UAAU,GAAQ,GAHtC,EAAA,2BAA2B,EAAK,EAAO,OAAO,EACvC,CAAC,GAHO,CAAC,CAMxB,CAEA,eAAe,EACX,EACA,EACA,EACA,EACiB,CACjB,GAAM,CAAE,OAAM,SAAQ,UAAS,SAAQ,UAAS,GAAG,GAAS,EACtD,EAAS,EAAW,CAAI,EACxB,EAAa,EAAS,EAAO,cAAgB,EAAO,QAEpD,EACF,IAAY,IAAA,GAAsB,IAAe,IAAA,GAFpC,EAAS,EAAyB,EAEc,EAArC,EAEtB,EAAM,EAAA,YAAY,EAAO,QAAS,EAAM,CAAE,OAAQ,EAAO,OAAQ,QAAO,CAAC,EAEzE,EAAgB,EAChB,EAAuC,CACzC,GAAI,EAAS,CAAC,EAAI,CAAE,eAAgB,kBAAmB,EACvD,GAAI,EAAY,CAAE,eAAgB,CAAU,EAAI,CAAC,EACjD,GAAG,EAAO,QACV,GAAG,EAAY,EAAK,CAAQ,EAC5B,GAAG,EAAA,YAAY,CACX,OAAQ,EAAK,QAAU,MACvB,MACA,UAAW,EAAO,QAClB,KAAM,EAAO,KACb,eAAgB,EAAO,eACvB,QAAS,CAAE,GAAG,EAAO,QAAS,GAAG,CAAc,CACnD,CAAC,EACD,GAAG,CACP,EAEM,EAAQ,EAAA,YAAY,EAAQ,CAAK,EACjC,EAAoB,CACtB,GAAG,EACH,OAAQ,EAAM,OACd,QAAS,EACT,YAAa,EAAO,gBAAkB,UAAY,EAAK,YACvD,KACI,GAA+B,KACzB,IAAA,GACA,EACG,EACD,KAAK,UAAU,CAAI,CACnC,EAEA,GAAI,CACA,OAAO,MAAM,EAAQ,EAAK,CAAI,CAClC,OAAS,EAAO,CAOZ,MANI,EAAM,SAAS,EACT,IAAI,EAAA,gBAAgB,CACtB,OAAQ,EACR,OAAQ,wBAAwB,EAAM,qBAC1C,CAAC,EAEC,CACV,QAAU,CACN,EAAM,QAAQ,CAClB,CACJ,CAEA,eAAe,EACX,EACA,EACA,EACA,EACA,EACiB,CACjB,IAAM,EAAM,EAAO,OACnB,GAAI,CAAC,EAAK,OAAO,EAAW,EAAM,EAAS,EAAW,CAAQ,EAE9D,IAAM,EAAY,YAAY,IAAI,EAClC,GAAI,CACA,IAAM,EAAW,MAAM,EAAW,EAAM,EAAS,EAAW,CAAQ,EAC9D,EAAQ,CAAE,YAAW,OAAQ,EAAS,OAAQ,GAAI,EAAU,CAAS,CAAE,EACvE,EAAO,GAAG,EAAO,GAAG,EAAK,KAAK,EAAS,SAG7C,OAFI,EAAS,QAAU,IAAK,EAAI,KAAK,EAAM,CAAK,EAC3C,EAAI,MAAM,EAAM,CAAK,EACnB,CACX,OAAS,EAAO,CAMZ,MALA,EAAI,KAAK,GAAG,EAAO,GAAG,EAAK,gBAAiB,CACxC,YACA,GAAI,EAAU,CAAS,EACvB,OACJ,CAAC,EACK,CACV,CACJ,CAEA,eAAe,EAAmB,EAAoB,EAAkC,CAC/E,KAAO,eACZ,GAAO,QAAQ,KAAK,wCAAyC,CACzD,YACA,OAAQ,EAAS,MACrB,CAAC,EACD,GAAI,CACA,MAAM,EAAO,eAAe,CAAQ,CACxC,OAAS,EAAO,CACZ,EAAO,QAAQ,KAAK,6DAA8D,CAC9E,YACA,OAAQ,EAAS,OACjB,OACJ,CAAC,CACL,CATC,CAUL,CAEA,eAAe,EACX,EACA,EACA,EACU,CACV,GAAM,CAAE,WAAW,GAAO,gBAAgB,GAAO,GAAG,GAAS,EACvD,EAAY,EAAO,UAAY,EAAO,UAAU,EAAI,EAAA,SAAS,EAC7D,GAAU,EAAK,QAAU,MAAA,CAAO,YAAY,EAC9C,EAAW,MAAM,EAAK,EAAM,EAAM,EAAW,EAAQ,CAAQ,EAEjE,GAAI,EAAS,SAAW,KAAO,CAAC,GAAY,CAAC,EAAe,CACxD,GAAI,EAAO,QAAS,CAChB,GAAI,CACA,MAAM,EAAO,QAAQ,EACrB,EAAW,MAAM,EAAK,EAAM,EAAM,EAAW,EAAQ,CAAQ,CACjE,MAAQ,CAEJ,MADA,MAAM,EAAmB,EAAU,CAAS,EACtC,MAAM,EAAW,EAAU,CAAS,CAC9C,CACI,EAAS,SAAW,KACpB,MAAM,EAAmB,EAAU,CAAS,CAEpD,MACI,MAAM,EAAmB,EAAU,CAAS,CAEpD,CAEA,GAAI,CAAC,EAAS,GACV,MAAM,MAAM,EAAW,EAAU,CAAS,EAG9C,OAAO,EAAO,CAAQ,CAC1B,CAEA,eAAe,EACX,EACA,EACA,EACU,CACV,GAAM,CAAE,MAAO,EAAY,GAAG,GAAS,EACjC,EAAe,EAAa,IAAe,IAAA,GAAyB,EAAO,MAApB,CAAyB,EACtF,GAAI,CAAC,EAAc,OAAO,EAAW,EAAM,EAAM,CAAM,EAEvD,IAAM,GAAU,EAAK,QAAU,MAAA,CAAO,YAAY,EAClD,OAAO,EAAA,UAAuB,EAAW,EAAM,EAAM,CAAM,EAAG,CAC1D,GAAG,EACH,YACI,EAAa,cAAiB,GAAmB,EAAmB,EAAO,CAAM,EACzF,CAAC,CACL,CAEA,eAAe,EAAW,EAAc,EAA0B,CAAC,EAAe,CAC9E,OAAO,EAAO,EAAM,EAAS,EAAA,mBAAmB,CACpD,CAEA,eAAe,EACX,EACA,EACA,EAAmC,OACnC,EACU,CACV,OAAO,EAAW,EAAM,CAAE,GAAG,EAAS,SAAQ,KAAM,CAAS,CAAC,CAClE,CAEA,MAAO,CACH,UACA,KAAS,EAAc,IACnB,EAAW,EAAM,CAAE,GAAG,EAAS,OAAQ,KAAM,CAAC,EAClD,MAAU,EAAc,IACpB,EAAW,EAAM,CAAE,GAAG,EAAS,OAAQ,MAAO,CAAC,EACnD,KAAS,EAAc,IACnB,EAAW,EAAM,CAAE,GAAG,EAAS,OAAQ,KAAM,CAAC,EAClD,OAAW,EAAc,IACrB,EAAW,EAAM,CAAE,GAAG,EAAS,OAAQ,OAAQ,CAAC,EACpD,QAAY,EAAc,IACtB,EAAW,EAAM,CAAE,GAAG,EAAS,OAAQ,QAAS,CAAC,EACrD,MAAO,EAAc,IACjB,EAAU,EAAM,CAAE,GAAG,CAAQ,EAAI,GAAa,EAAS,KAAK,CAAC,EACjE,aAAc,EAAc,IACxB,EAAiB,EAAM,CAAE,GAAG,CAAQ,EAAI,GAAa,EAAS,YAAY,CAAC,EAC/E,QACJ,CACJ"}
+{"version":3,"file":"api-client.cjs","names":[],"sources":["../../src/http/api-client.ts"],"sourcesContent":["/**\n * @tempest-limits function-lines — createApiClient is over the limit and every line\n * is a request-lifecycle concern the client cannot delegate: base URL joining, the\n * auth header, the 401 refresh-and-replay, the opt-in retry wrapper and the response\n * parsing that turns a failure into a typed error.\n */\nimport { randomId } from \"../utils\";\nimport { buildApiUrl } from \"./build-url\";\nimport { isTrustedCredentialTarget, reportSuppressedCredential } from \"./credential-scope\";\nimport { csrfHeaders } from \"./csrf\";\nimport { decodeByContentType } from \"./decode-response\";\nimport type { ResponseDecoder } from \"./decode-response\";\nimport {\n    buildApiError,\n    SessionSupersededError,\n    TempestApiError,\n    isRetriableStatus,\n} from \"./errors\";\nimport { retry as retryWithBackoff } from \"./retry\";\nimport type { RetryOptions } from \"./retry\";\nimport { withTimeout } from \"./timeout\";\nimport type { ApiClient, ApiClientConfig, RequestAuthContext, RequestOptions } from \"./types\";\n\n/**\n * Methods the built-in retry policy will replay.\n *\n * `PUT` and `DELETE` are idempotent on paper but stay out: a backend that logs,\n * bills, or fires a webhook per call still sees two, so replaying them is a\n * decision the caller makes through `shouldRetry`, not a default.\n */\nconst IDEMPOTENT_METHODS: ReadonlySet<string> = new Set([\"GET\", \"HEAD\", \"OPTIONS\"]);\n\n/**\n * Sub-500 statuses worth a second attempt: a network failure (status `0`), a\n * request timeout, a too-early replay, and a rate limit — which usually carries\n * the `Retry-After` the backoff already honours.\n */\n\n/**\n * The built-in retry policy, used when `retry` is `true` or is options carrying\n * no `shouldRetry` of their own.\n *\n * Conservative on purpose. Replaying a write can duplicate it, and replaying a\n * `400` or a `403` cannot fix a bad payload or a permission the caller does not\n * have — it only spends the user's time before showing the same error.\n *\n * @param error - Whatever the attempt threw.\n * @param method - The upper-cased HTTP method of the request.\n * @returns Whether the client should try again.\n */\nfunction isRetriableFailure(error: unknown, method: string): boolean {\n    if (!IDEMPOTENT_METHODS.has(method)) return false;\n    if (!(error instanceof TempestApiError)) return false;\n    return isRetriableStatus(error.status);\n}\n\n/**\n * Normalize the `retry` config into options, or `null` when retrying is off.\n *\n * @param config - The `retry` field as the caller wrote it.\n * @returns Retry options to use, or `null` to run a single attempt.\n */\nfunction resolveRetry(config: boolean | RetryOptions | undefined): RetryOptions | null {\n    if (!config) return null;\n    return config === true ? {} : config;\n}\n\n/** Default milliseconds before a request is abandoned. */\nconst DEFAULT_TIMEOUT = 15_000;\n\n/** Default milliseconds before a `FormData` request is abandoned. */\nconst DEFAULT_UPLOAD_TIMEOUT = 300_000;\n\nfunction isFormData(body: unknown): body is FormData {\n    return typeof FormData !== \"undefined\" && body instanceof FormData;\n}\n\n/**\n * Milliseconds since a `performance.now()` reading, rounded.\n *\n * `performance.now()` rather than `Date.now()` because this measures a\n * duration: the wall clock can step sideways mid-request (an NTP correction, a\n * VM resuming, the user changing the clock) and turn a 40 ms call into a\n * negative number. The monotonic clock cannot.\n *\n * @param startedAt - The reading taken before the work started.\n * @returns Whole milliseconds elapsed.\n */\nfunction elapsedMs(startedAt: number): number {\n    return Math.round(performance.now() - startedAt);\n}\n\nasync function parseError(response: Response, sentRequestId?: string): Promise<TempestApiError> {\n    let body: unknown;\n    try {\n        body = await response.clone().json();\n    } catch {\n        try {\n            body = await response.text();\n        } catch {\n            body = null;\n        }\n    }\n    return new TempestApiError(\n        buildApiError(response.status, body, response.headers, sentRequestId),\n    );\n}\n\n/**\n * Create a typed HTTP client backed by `fetch`.\n *\n * Handles JSON serialization, query params, bearer auth via `getToken`, uploads\n * via `FormData`, and throws a typed `ApiError` on any non-2xx response.\n *\n * **Expired sessions.** A `401` with `refresh` configured awaits the refresh and\n * replays the request once. `onUnauthorized` fires whenever that path ends\n * unauthorized anyway — the refresh threw, or the replay came back `401` — which\n * is the signal to clear the session. Without `refresh`, the first `401` calls\n * it directly.\n *\n * **Binary bodies** have their own methods — `blob()` and `arrayBuffer()` — which\n * run the same pipeline and skip the parse. `request()` no longer decodes an\n * unknown `Content-Type` as text either: it returns a `Blob` and says so once in\n * a development build, because reading `image/jpeg` as UTF-8 destroyed the bytes\n * on the way in.\n *\n * **The bearer token is scoped to `baseURL`'s origin** since 0.66.0. A path may\n * be an absolute URL, which overrides the base entirely, so without a scope the\n * destination of a credentialed request could come from a value read off the\n * network. A request to another origin still goes out; it goes without the\n * header, and a development build says so once. Declare the exceptions in\n * {@link ApiClientConfig.trustedOrigins}.\n *\n * **CSRF** is off unless you set `csrf`. With it, every unsafe request (anything\n * but `GET`/`HEAD`/`OPTIONS`/`TRACE`) echoes the `csrf_token` cookie in an\n * `X-CSRF-Token` header — the double-submit contract of `tempest-fastapi-sdk`'s\n * `CSRFMiddleware` — scoped to the same origins as the bearer token and sent on\n * `skipAuth` requests too. See {@link ApiClientConfig.csrf}.\n *\n * **Retries** are off unless you set `retry`. See {@link ApiClientConfig.retry}\n * for the built-in policy; it never replays a write. A single call overrides it\n * with {@link RequestOptions.retry}, and opts out of auth entirely with\n * {@link RequestOptions.skipAuth}.\n *\n * **Logging** is off unless you pass a `logger`. With one, every finished attempt\n * writes a line — `debug` under 400, `warn` from 400 up, plus a `warn` when\n * `onUnauthorized` fires — carrying `requestId`, `status` and elapsed `ms`, and\n * never a body, header or query string. The level and the destination belong to\n * the logger, not to a boolean here.\n *\n * @example\n * const api = createApiClient({\n *     baseURL: import.meta.env.VITE_API_URL,\n *     getToken: () => useAuthStore.getState().token,\n *     refresh,\n *     onUnauthorized: () => useAuthStore.getState().logout(),\n *     logger: createLogger({ level: import.meta.env.DEV ? \"debug\" : \"warn\" }).child(\"http\"),\n *     retry: true,\n * });\n *\n * @param config - Base URL plus the optional auth, retry and fetch hooks.\n * @returns A client with `request`/`get`/`post`/`put`/`patch`/`delete`/`blob`/\n * `arrayBuffer`/`upload`.\n */\nexport function createApiClient(config: ApiClientConfig): ApiClient {\n    const fetcher = config.fetcher ?? globalThis.fetch.bind(globalThis);\n\n    /**\n     * The `Authorization` header for a request, or nothing.\n     *\n     * Takes the resolved URL rather than reading `config.baseURL`, because an\n     * absolute path overrides the base entirely (see `buildApiUrl`) and the\n     * credential is scoped to an origin, not to a client.\n     *\n     * @param url - The absolute URL the request is going to.\n     * @param skipAuth - Whether the caller opted this request out of auth.\n     * @returns The header, or an empty object.\n     */\n    function authHeaders(url: string, skipAuth: boolean): Record<string, string> {\n        if (skipAuth) return {};\n        const token = config.getToken?.();\n        if (!token) return {};\n        if (!isTrustedCredentialTarget(url, config.baseURL, config.trustedOrigins)) {\n            reportSuppressedCredential(url, config.baseURL);\n            return {};\n        }\n        return { Authorization: `Bearer ${token}` };\n    }\n\n    async function rawRequest(\n        path: string,\n        options: RequestOptions,\n        requestId: string | undefined,\n        skipAuth: boolean,\n    ): Promise<Response> {\n        const { body, params, headers, signal, timeout, ...rest } = options;\n        const isForm = isFormData(body);\n        const configured = isForm ? config.uploadTimeout : config.timeout;\n        const fallback = isForm ? DEFAULT_UPLOAD_TIMEOUT : DEFAULT_TIMEOUT;\n        const limit =\n            timeout !== undefined ? timeout : configured !== undefined ? configured : fallback;\n\n        const url = buildApiUrl(config.baseURL, path, { prefix: config.prefix, params });\n\n        const callerHeaders = headers as Record<string, string> | undefined;\n        const finalHeaders: Record<string, string> = {\n            ...(isForm ? {} : { \"Content-Type\": \"application/json\" }),\n            ...(requestId ? { \"X-Request-ID\": requestId } : {}),\n            ...config.headers,\n            ...authHeaders(url, skipAuth),\n            ...csrfHeaders({\n                method: rest.method ?? \"GET\",\n                url,\n                reference: config.baseURL,\n                csrf: config.csrf,\n                trustedOrigins: config.trustedOrigins,\n                headers: { ...config.headers, ...callerHeaders },\n            }),\n            ...callerHeaders,\n        };\n\n        const timed = withTimeout(signal, limit);\n        const init: RequestInit = {\n            ...rest,\n            signal: timed.signal,\n            headers: finalHeaders,\n            credentials: config.withCredentials ? \"include\" : rest.credentials,\n            body:\n                body === undefined || body === null\n                    ? undefined\n                    : isForm\n                      ? (body as FormData)\n                      : JSON.stringify(body),\n        };\n\n        try {\n            return await fetcher(url, init);\n        } catch (cause) {\n            if (timed.timedOut()) {\n                throw new TempestApiError({\n                    status: 0,\n                    detail: `A requisição excedeu ${limit}ms e foi abandonada.`,\n                });\n            }\n            throw cause;\n        } finally {\n            timed.dispose();\n        }\n    }\n\n    async function send(\n        path: string,\n        options: RequestOptions,\n        requestId: string,\n        method: string,\n        skipAuth: boolean,\n    ): Promise<Response> {\n        const log = config.logger;\n        if (!log) return rawRequest(path, options, requestId, skipAuth);\n\n        const startedAt = performance.now();\n        try {\n            const response = await rawRequest(path, options, requestId, skipAuth);\n            const entry = { requestId, status: response.status, ms: elapsedMs(startedAt) };\n            const line = `${method} ${path} → ${response.status}`;\n            if (response.status >= 400) log.warn(line, entry);\n            else log.debug(line, entry);\n            return response;\n        } catch (error) {\n            log.warn(`${method} ${path} → no response`, {\n                requestId,\n                ms: elapsedMs(startedAt),\n                error,\n            });\n            throw error;\n        }\n    }\n\n    /**\n     * Call `onUnauthorized`, keeping the request's own error unless the hook\n     * says the attempt belongs to an ended session.\n     *\n     * @param response - The `401` that ended the attempt.\n     * @param requestId - Correlation id for the log.\n     * @param context - The credential and session the attempt left with.\n     * @throws {SessionSupersededError} When `onUnauthorized` threw it.\n     */\n    async function notifyUnauthorized(\n        response: Response,\n        requestId: string,\n        context: RequestAuthContext,\n    ): Promise<void> {\n        if (!config.onUnauthorized) return;\n        config.logger?.warn(`unauthorized — calling onUnauthorized`, {\n            requestId,\n            status: response.status,\n        });\n        try {\n            await config.onUnauthorized(response, context);\n        } catch (error) {\n            if (error instanceof SessionSupersededError) throw error;\n            config.logger?.warn(`onUnauthorized threw — keeping the original response error`, {\n                requestId,\n                status: response.status,\n                error,\n            });\n        }\n    }\n\n    /**\n     * The credential and session an attempt leaves with, read just before it is\n     * sent.\n     *\n     * @param skipAuth - Whether the attempt goes out without credentials.\n     * @returns The context handed to `refresh` and `onUnauthorized`.\n     */\n    function authContext(skipAuth: boolean): RequestAuthContext {\n        return {\n            token: skipAuth ? null : (config.getToken?.() ?? null),\n            epoch: config.getSessionEpoch?.() ?? null,\n        };\n    }\n\n    async function attempt<T>(\n        path: string,\n        options: RequestOptions,\n        decode: ResponseDecoder<T>,\n    ): Promise<T> {\n        const { skipAuth = false, skipAuthRetry = false, ...init } = options;\n        const requestId = config.requestId ? config.requestId() : randomId();\n        const method = (init.method ?? \"GET\").toUpperCase();\n        const sent = authContext(skipAuth);\n        let response = await send(path, init, requestId, method, skipAuth);\n\n        if (response.status === 401 && !skipAuth && !skipAuthRetry) {\n            if (config.refresh) {\n                let replayed: RequestAuthContext;\n                try {\n                    await config.refresh(sent);\n                    replayed = authContext(skipAuth);\n                    response = await send(path, init, requestId, method, skipAuth);\n                } catch (error) {\n                    if (error instanceof SessionSupersededError) throw error;\n                    await notifyUnauthorized(response, requestId, sent);\n                    throw await parseError(response, requestId);\n                }\n                if (response.status === 401) {\n                    await notifyUnauthorized(response, requestId, replayed);\n                }\n            } else {\n                await notifyUnauthorized(response, requestId, sent);\n            }\n        }\n\n        if (!response.ok) {\n            throw await parseError(response, requestId);\n        }\n\n        return decode(response);\n    }\n\n    async function run<T>(\n        path: string,\n        options: RequestOptions,\n        decode: ResponseDecoder<T>,\n    ): Promise<T> {\n        const { retry: perRequest, ...rest } = options;\n        const retryOptions = resolveRetry(perRequest !== undefined ? perRequest : config.retry);\n        if (!retryOptions) return attempt<T>(path, rest, decode);\n\n        const method = (rest.method ?? \"GET\").toUpperCase();\n        return retryWithBackoff(() => attempt<T>(path, rest, decode), {\n            ...retryOptions,\n            shouldRetry:\n                retryOptions.shouldRetry ?? ((error: unknown) => isRetriableFailure(error, method)),\n        });\n    }\n\n    async function request<T>(path: string, options: RequestOptions = {}): Promise<T> {\n        return run<T>(path, options, decodeByContentType);\n    }\n\n    async function upload<T>(\n        path: string,\n        formData: FormData,\n        method: \"POST\" | \"PUT\" | \"PATCH\" = \"POST\",\n        options?: Omit<RequestOptions, \"body\" | \"method\">,\n    ): Promise<T> {\n        return request<T>(path, { ...options, method, body: formData });\n    }\n\n    return {\n        request,\n        get: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"GET\" }),\n        post: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"POST\" }),\n        put: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"PUT\" }),\n        patch: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"PATCH\" }),\n        delete: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"DELETE\" }),\n        blob: (path: string, options?: RequestOptions) =>\n            run<Blob>(path, { ...options }, (response) => response.blob()),\n        arrayBuffer: (path: string, options?: RequestOptions) =>\n            run<ArrayBuffer>(path, { ...options }, (response) => response.arrayBuffer()),\n        upload,\n    };\n}\n"],"mappings":"8OA8BA,IAAM,EAA0C,IAAI,IAAI,CAAC,MAAO,OAAQ,SAAS,CAAC,EAoBlF,SAAS,EAAmB,EAAgB,EAAyB,CAGjE,MAFI,CAAC,EAAmB,IAAI,CAAM,GAC9B,EAAE,aAAiB,EAAA,iBAAyB,GACzC,EAAA,kBAAkB,EAAM,MAAM,CACzC,CAQA,SAAS,EAAa,EAAiE,CAEnF,OADK,EACE,IAAW,GAAO,CAAC,EAAI,EADV,IAExB,CAGA,IAAM,EAAkB,KAGlB,EAAyB,IAE/B,SAAS,EAAW,EAAiC,CACjD,OAAO,OAAO,SAAa,KAAe,aAAgB,QAC9D,CAaA,SAAS,EAAU,EAA2B,CAC1C,OAAO,KAAK,MAAM,YAAY,IAAI,EAAI,CAAS,CACnD,CAEA,eAAe,EAAW,EAAoB,EAAkD,CAC5F,IAAI,EACJ,GAAI,CACA,EAAO,MAAM,EAAS,MAAM,CAAC,CAAC,KAAK,CACvC,MAAQ,CACJ,GAAI,CACA,EAAO,MAAM,EAAS,KAAK,CAC/B,MAAQ,CACJ,EAAO,IACX,CACJ,CACA,OAAO,IAAI,EAAA,gBACP,EAAA,cAAc,EAAS,OAAQ,EAAM,EAAS,QAAS,CAAa,CACxE,CACJ,CA0DA,SAAgB,EAAgB,EAAoC,CAChE,IAAM,EAAU,EAAO,SAAW,WAAW,MAAM,KAAK,UAAU,EAalE,SAAS,EAAY,EAAa,EAA2C,CACzE,GAAI,EAAU,MAAO,CAAC,EACtB,IAAM,EAAQ,EAAO,WAAW,EAMhC,OALK,EACA,EAAA,0BAA0B,EAAK,EAAO,QAAS,EAAO,cAAc,EAIlE,CAAE,cAAe,UAAU,GAAQ,GAHtC,EAAA,2BAA2B,EAAK,EAAO,OAAO,EACvC,CAAC,GAHO,CAAC,CAMxB,CAEA,eAAe,EACX,EACA,EACA,EACA,EACiB,CACjB,GAAM,CAAE,OAAM,SAAQ,UAAS,SAAQ,UAAS,GAAG,GAAS,EACtD,EAAS,EAAW,CAAI,EACxB,EAAa,EAAS,EAAO,cAAgB,EAAO,QAEpD,EACF,IAAY,IAAA,GAAsB,IAAe,IAAA,GAFpC,EAAS,EAAyB,EAEc,EAArC,EAEtB,EAAM,EAAA,YAAY,EAAO,QAAS,EAAM,CAAE,OAAQ,EAAO,OAAQ,QAAO,CAAC,EAEzE,EAAgB,EAChB,EAAuC,CACzC,GAAI,EAAS,CAAC,EAAI,CAAE,eAAgB,kBAAmB,EACvD,GAAI,EAAY,CAAE,eAAgB,CAAU,EAAI,CAAC,EACjD,GAAG,EAAO,QACV,GAAG,EAAY,EAAK,CAAQ,EAC5B,GAAG,EAAA,YAAY,CACX,OAAQ,EAAK,QAAU,MACvB,MACA,UAAW,EAAO,QAClB,KAAM,EAAO,KACb,eAAgB,EAAO,eACvB,QAAS,CAAE,GAAG,EAAO,QAAS,GAAG,CAAc,CACnD,CAAC,EACD,GAAG,CACP,EAEM,EAAQ,EAAA,YAAY,EAAQ,CAAK,EACjC,EAAoB,CACtB,GAAG,EACH,OAAQ,EAAM,OACd,QAAS,EACT,YAAa,EAAO,gBAAkB,UAAY,EAAK,YACvD,KACI,GAA+B,KACzB,IAAA,GACA,EACG,EACD,KAAK,UAAU,CAAI,CACnC,EAEA,GAAI,CACA,OAAO,MAAM,EAAQ,EAAK,CAAI,CAClC,OAAS,EAAO,CAOZ,MANI,EAAM,SAAS,EACT,IAAI,EAAA,gBAAgB,CACtB,OAAQ,EACR,OAAQ,wBAAwB,EAAM,qBAC1C,CAAC,EAEC,CACV,QAAU,CACN,EAAM,QAAQ,CAClB,CACJ,CAEA,eAAe,EACX,EACA,EACA,EACA,EACA,EACiB,CACjB,IAAM,EAAM,EAAO,OACnB,GAAI,CAAC,EAAK,OAAO,EAAW,EAAM,EAAS,EAAW,CAAQ,EAE9D,IAAM,EAAY,YAAY,IAAI,EAClC,GAAI,CACA,IAAM,EAAW,MAAM,EAAW,EAAM,EAAS,EAAW,CAAQ,EAC9D,EAAQ,CAAE,YAAW,OAAQ,EAAS,OAAQ,GAAI,EAAU,CAAS,CAAE,EACvE,EAAO,GAAG,EAAO,GAAG,EAAK,KAAK,EAAS,SAG7C,OAFI,EAAS,QAAU,IAAK,EAAI,KAAK,EAAM,CAAK,EAC3C,EAAI,MAAM,EAAM,CAAK,EACnB,CACX,OAAS,EAAO,CAMZ,MALA,EAAI,KAAK,GAAG,EAAO,GAAG,EAAK,gBAAiB,CACxC,YACA,GAAI,EAAU,CAAS,EACvB,OACJ,CAAC,EACK,CACV,CACJ,CAWA,eAAe,EACX,EACA,EACA,EACa,CACR,KAAO,eACZ,GAAO,QAAQ,KAAK,wCAAyC,CACzD,YACA,OAAQ,EAAS,MACrB,CAAC,EACD,GAAI,CACA,MAAM,EAAO,eAAe,EAAU,CAAO,CACjD,OAAS,EAAO,CACZ,GAAI,aAAiB,EAAA,uBAAwB,MAAM,EACnD,EAAO,QAAQ,KAAK,6DAA8D,CAC9E,YACA,OAAQ,EAAS,OACjB,OACJ,CAAC,CACL,CAVC,CAWL,CASA,SAAS,EAAY,EAAuC,CACxD,MAAO,CACH,MAAO,EAAW,KAAQ,EAAO,WAAW,GAAK,KACjD,MAAO,EAAO,kBAAkB,GAAK,IACzC,CACJ,CAEA,eAAe,EACX,EACA,EACA,EACU,CACV,GAAM,CAAE,WAAW,GAAO,gBAAgB,GAAO,GAAG,GAAS,EACvD,EAAY,EAAO,UAAY,EAAO,UAAU,EAAI,EAAA,SAAS,EAC7D,GAAU,EAAK,QAAU,MAAA,CAAO,YAAY,EAC5C,EAAO,EAAY,CAAQ,EAC7B,EAAW,MAAM,EAAK,EAAM,EAAM,EAAW,EAAQ,CAAQ,EAEjE,GAAI,EAAS,SAAW,KAAO,CAAC,GAAY,CAAC,EAAe,CACxD,GAAI,EAAO,QAAS,CAChB,IAAI,EACJ,GAAI,CACA,MAAM,EAAO,QAAQ,CAAI,EACzB,EAAW,EAAY,CAAQ,EAC/B,EAAW,MAAM,EAAK,EAAM,EAAM,EAAW,EAAQ,CAAQ,CACjE,OAAS,EAAO,CAGZ,MAFI,aAAiB,EAAA,uBAA8B,GACnD,MAAM,EAAmB,EAAU,EAAW,CAAI,EAC5C,MAAM,EAAW,EAAU,CAAS,EAC9C,CACI,EAAS,SAAW,KACpB,MAAM,EAAmB,EAAU,EAAW,CAAQ,CAE9D,MACI,MAAM,EAAmB,EAAU,EAAW,CAAI,CAE1D,CAEA,GAAI,CAAC,EAAS,GACV,MAAM,MAAM,EAAW,EAAU,CAAS,EAG9C,OAAO,EAAO,CAAQ,CAC1B,CAEA,eAAe,EACX,EACA,EACA,EACU,CACV,GAAM,CAAE,MAAO,EAAY,GAAG,GAAS,EACjC,EAAe,EAAa,IAAe,IAAA,GAAyB,EAAO,MAApB,CAAyB,EACtF,GAAI,CAAC,EAAc,OAAO,EAAW,EAAM,EAAM,CAAM,EAEvD,IAAM,GAAU,EAAK,QAAU,MAAA,CAAO,YAAY,EAClD,OAAO,EAAA,UAAuB,EAAW,EAAM,EAAM,CAAM,EAAG,CAC1D,GAAG,EACH,YACI,EAAa,cAAiB,GAAmB,EAAmB,EAAO,CAAM,EACzF,CAAC,CACL,CAEA,eAAe,EAAW,EAAc,EAA0B,CAAC,EAAe,CAC9E,OAAO,EAAO,EAAM,EAAS,EAAA,mBAAmB,CACpD,CAEA,eAAe,EACX,EACA,EACA,EAAmC,OACnC,EACU,CACV,OAAO,EAAW,EAAM,CAAE,GAAG,EAAS,SAAQ,KAAM,CAAS,CAAC,CAClE,CAEA,MAAO,CACH,UACA,KAAS,EAAc,IACnB,EAAW,EAAM,CAAE,GAAG,EAAS,OAAQ,KAAM,CAAC,EAClD,MAAU,EAAc,IACpB,EAAW,EAAM,CAAE,GAAG,EAAS,OAAQ,MAAO,CAAC,EACnD,KAAS,EAAc,IACnB,EAAW,EAAM,CAAE,GAAG,EAAS,OAAQ,KAAM,CAAC,EAClD,OAAW,EAAc,IACrB,EAAW,EAAM,CAAE,GAAG,EAAS,OAAQ,OAAQ,CAAC,EACpD,QAAY,EAAc,IACtB,EAAW,EAAM,CAAE,GAAG,EAAS,OAAQ,QAAS,CAAC,EACrD,MAAO,EAAc,IACjB,EAAU,EAAM,CAAE,GAAG,CAAQ,EAAI,GAAa,EAAS,KAAK,CAAC,EACjE,aAAc,EAAc,IACxB,EAAiB,EAAM,CAAE,GAAG,CAAQ,EAAI,GAAa,EAAS,YAAY,CAAC,EAC/E,QACJ,CACJ"}

package/dist/http/api-client.js

@@ -3,29 +3,29 @@ import { buildApiUrl as t } from "./build-url.js";
 import { isTrustedCredentialTarget as n, reportSuppressedCredential as r } from "./credential-scope.js";
 import { csrfHeaders as i } from "./csrf.js";
 import { decodeByContentType as a } from "./decode-response.js";
-import { TempestApiError as o, buildApiError as s, isRetriableStatus as c } from "./errors.js";
-import { retry as l } from "./retry.js";
-import { withTimeout as u } from "./timeout.js";
+import { SessionSupersededError as o, TempestApiError as s, buildApiError as c, isRetriableStatus as l } from "./errors.js";
+import { retry as u } from "./retry.js";
+import { withTimeout as d } from "./timeout.js";
 //#region src/http/api-client.ts
-var d = /* @__PURE__ */ new Set([
+var f = /* @__PURE__ */ new Set([
 	"GET",
 	"HEAD",
 	"OPTIONS"
 ]);
-function f(e, t) {
-	return !d.has(t) || !(e instanceof o) ? !1 : c(e.status);
+function p(e, t) {
+	return !f.has(t) || !(e instanceof s) ? !1 : l(e.status);
 }
-function p(e) {
+function m(e) {
 	return e ? e === !0 ? {} : e : null;
 }
-var m = 15e3, h = 3e5;
-function g(e) {
+var h = 15e3, g = 3e5;
+function _(e) {
 	return typeof FormData < "u" && e instanceof FormData;
 }
-function _(e) {
+function v(e) {
 	return Math.round(performance.now() - e);
 }
-async function v(e, t) {
+async function y(e, t) {
 	let n;
 	try {
 		n = await e.clone().json();
@@ -36,47 +36,47 @@ async function v(e, t) {
 			n = null;
 		}
 	}
-	return new o(s(e.status, n, e.headers, t));
+	return new s(c(e.status, n, e.headers, t));
 }
-function y(s) {
-	let c = s.fetcher ?? globalThis.fetch.bind(globalThis);
-	function d(e, t) {
+function b(c) {
+	let l = c.fetcher ?? globalThis.fetch.bind(globalThis);
+	function f(e, t) {
 		if (t) return {};
-		let i = s.getToken?.();
-		return i ? n(e, s.baseURL, s.trustedOrigins) ? { Authorization: `Bearer ${i}` } : (r(e, s.baseURL), {}) : {};
+		let i = c.getToken?.();
+		return i ? n(e, c.baseURL, c.trustedOrigins) ? { Authorization: `Bearer ${i}` } : (r(e, c.baseURL), {}) : {};
 	}
-	async function y(e, n, r, a) {
-		let { body: l, params: f, headers: p, signal: _, timeout: v, ...y } = n, b = g(l), x = b ? s.uploadTimeout : s.timeout, S = v === void 0 ? x === void 0 ? b ? h : m : x : v, C = t(s.baseURL, e, {
-			prefix: s.prefix,
-			params: f
+	async function b(e, n, r, a) {
+		let { body: o, params: u, headers: p, signal: m, timeout: v, ...y } = n, b = _(o), x = b ? c.uploadTimeout : c.timeout, S = v === void 0 ? x === void 0 ? b ? g : h : x : v, C = t(c.baseURL, e, {
+			prefix: c.prefix,
+			params: u
 		}), w = p, T = {
 			...b ? {} : { "Content-Type": "application/json" },
 			...r ? { "X-Request-ID": r } : {},
-			...s.headers,
-			...d(C, a),
+			...c.headers,
+			...f(C, a),
 			...i({
 				method: y.method ?? "GET",
 				url: C,
-				reference: s.baseURL,
-				csrf: s.csrf,
-				trustedOrigins: s.trustedOrigins,
+				reference: c.baseURL,
+				csrf: c.csrf,
+				trustedOrigins: c.trustedOrigins,
 				headers: {
-					...s.headers,
+					...c.headers,
 					...w
 				}
 			}),
 			...w
-		}, E = u(_, S), D = {
+		}, E = d(m, S), D = {
 			...y,
 			signal: E.signal,
 			headers: T,
-			credentials: s.withCredentials ? "include" : y.credentials,
-			body: l == null ? void 0 : b ? l : JSON.stringify(l)
+			credentials: c.withCredentials ? "include" : y.credentials,
+			body: o == null ? void 0 : b ? o : JSON.stringify(o)
 		};
 		try {
-			return await c(C, D);
+			return await l(C, D);
 		} catch (e) {
-			throw E.timedOut() ? new o({
+			throw E.timedOut() ? new s({
 				status: 0,
 				detail: `A requisição excedeu ${S}ms e foi abandonada.`
 			}) : e;
@@ -84,35 +84,36 @@ function y(s) {
 			E.dispose();
 		}
 	}
-	async function b(e, t, n, r, i) {
-		let a = s.logger;
-		if (!a) return y(e, t, n, i);
+	async function x(e, t, n, r, i) {
+		let a = c.logger;
+		if (!a) return b(e, t, n, i);
 		let o = performance.now();
 		try {
-			let s = await y(e, t, n, i), c = {
+			let s = await b(e, t, n, i), c = {
 				requestId: n,
 				status: s.status,
-				ms: _(o)
+				ms: v(o)
 			}, l = `${r} ${e} → ${s.status}`;
 			return s.status >= 400 ? a.warn(l, c) : a.debug(l, c), s;
 		} catch (t) {
 			throw a.warn(`${r} ${e} → no response`, {
 				requestId: n,
-				ms: _(o),
+				ms: v(o),
 				error: t
 			}), t;
 		}
 	}
-	async function x(e, t) {
-		if (s.onUnauthorized) {
-			s.logger?.warn("unauthorized — calling onUnauthorized", {
+	async function S(e, t, n) {
+		if (c.onUnauthorized) {
+			c.logger?.warn("unauthorized — calling onUnauthorized", {
 				requestId: t,
 				status: e.status
 			});
 			try {
-				await s.onUnauthorized(e);
+				await c.onUnauthorized(e, n);
 			} catch (n) {
-				s.logger?.warn("onUnauthorized threw — keeping the original response error", {
+				if (n instanceof o) throw n;
+				c.logger?.warn("onUnauthorized threw — keeping the original response error", {
 					requestId: t,
 					status: e.status,
 					error: n
@@ -120,68 +121,75 @@ function y(s) {
 			}
 		}
 	}
-	async function S(t, n, r) {
-		let { skipAuth: i = !1, skipAuthRetry: a = !1, ...o } = n, c = s.requestId ? s.requestId() : e(), l = (o.method ?? "GET").toUpperCase(), u = await b(t, o, c, l, i);
-		if (u.status === 401 && !i && !a) {
-			if (s.refresh) {
+	function C(e) {
+		return {
+			token: e ? null : c.getToken?.() ?? null,
+			epoch: c.getSessionEpoch?.() ?? null
+		};
+	}
+	async function w(t, n, r) {
+		let { skipAuth: i = !1, skipAuthRetry: a = !1, ...s } = n, l = c.requestId ? c.requestId() : e(), u = (s.method ?? "GET").toUpperCase(), d = C(i), f = await x(t, s, l, u, i);
+		if (f.status === 401 && !i && !a) {
+			if (c.refresh) {
+				let e;
 				try {
-					await s.refresh(), u = await b(t, o, c, l, i);
-				} catch {
-					throw await x(u, c), await v(u, c);
+					await c.refresh(d), e = C(i), f = await x(t, s, l, u, i);
+				} catch (e) {
+					throw e instanceof o ? e : (await S(f, l, d), await y(f, l));
 				}
-				u.status === 401 && await x(u, c);
-			} else await x(u, c);
+				f.status === 401 && await S(f, l, e);
+			} else await S(f, l, d);
 		}
-		if (!u.ok) throw await v(u, c);
-		return r(u);
+		if (!f.ok) throw await y(f, l);
+		return r(f);
 	}
-	async function C(e, t, n) {
-		let { retry: r, ...i } = t, a = p(r === void 0 ? s.retry : r);
-		if (!a) return S(e, i, n);
+	async function T(e, t, n) {
+		let { retry: r, ...i } = t, a = m(r === void 0 ? c.retry : r);
+		if (!a) return w(e, i, n);
 		let o = (i.method ?? "GET").toUpperCase();
-		return l(() => S(e, i, n), {
+		return u(() => w(e, i, n), {
 			...a,
-			shouldRetry: a.shouldRetry ?? ((e) => f(e, o))
+			shouldRetry: a.shouldRetry ?? ((e) => p(e, o))
 		});
 	}
-	async function w(e, t = {}) {
-		return C(e, t, a);
+	async function E(e, t = {}) {
+		return T(e, t, a);
 	}
-	async function T(e, t, n = "POST", r) {
-		return w(e, {
+	async function D(e, t, n = "POST", r) {
+		return E(e, {
 			...r,
 			method: n,
 			body: t
 		});
 	}
 	return {
-		request: w,
-		get: (e, t) => w(e, {
+		request: E,
+		get: (e, t) => E(e, {
 			...t,
 			method: "GET"
 		}),
-		post: (e, t) => w(e, {
+		post: (e, t) => E(e, {
 			...t,
 			method: "POST"
 		}),
-		put: (e, t) => w(e, {
+		put: (e, t) => E(e, {
 			...t,
 			method: "PUT"
 		}),
-		patch: (e, t) => w(e, {
+		patch: (e, t) => E(e, {
 			...t,
 			method: "PATCH"
 		}),
-		delete: (e, t) => w(e, {
+		delete: (e, t) => E(e, {
 			...t,
 			method: "DELETE"
 		}),
-		blob: (e, t) => C(e, { ...t }, (e) => e.blob()),
-		arrayBuffer: (e, t) => C(e, { ...t }, (e) => e.arrayBuffer()),
-		upload: T
+		blob: (e, t) => T(e, { ...t }, (e) => e.blob()),
+		arrayBuffer: (e, t) => T(e, { ...t }, (e) => e.arrayBuffer()),
+		upload: D
 	};
 }
 //#endregion
-export { y as createApiClient };
+export { b as createApiClient };
 
 //# sourceMappingURL=api-client.js.map