tempest-react-sdk 0.78.0 → 0.80.0

package/dist/http/api-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.js","names":[],"sources":["../../src/http/api-client.ts"],"sourcesContent":["/**\n * @tempest-limits function-lines — createApiClient is over the limit and every line\n * is a request-lifecycle concern the client cannot delegate: base URL joining, the\n * auth header, the 401 refresh-and-replay, the opt-in retry wrapper and the response\n * parsing that turns a failure into a typed error.\n */\nimport { randomId } from \"../utils\";\nimport { buildApiUrl } from \"./build-url\";\nimport { isTrustedCredentialTarget, reportSuppressedCredential } from \"./credential-scope\";\nimport { csrfHeaders } from \"./csrf\";\nimport { decodeByContentType } from \"./decode-response\";\nimport type { ResponseDecoder } from \"./decode-response\";\nimport {\n    buildApiError,\n    SessionSupersededError,\n    TempestApiError,\n    isRetriableStatus,\n} from \"./errors\";\nimport { retry as retryWithBackoff } from \"./retry\";\nimport type { RetryOptions } from \"./retry\";\nimport { withTimeout } from \"./timeout\";\nimport type { ApiClient, ApiClientConfig, RequestAuthContext, RequestOptions } from \"./types\";\n\n/**\n * Methods the built-in retry policy will replay.\n *\n * `PUT` and `DELETE` are idempotent on paper but stay out: a backend that logs,\n * bills, or fires a webhook per call still sees two, so replaying them is a\n * decision the caller makes through `shouldRetry`, not a default.\n */\nconst IDEMPOTENT_METHODS: ReadonlySet<string> = new Set([\"GET\", \"HEAD\", \"OPTIONS\"]);\n\n/**\n * Sub-500 statuses worth a second attempt: a network failure (status `0`), a\n * request timeout, a too-early replay, and a rate limit — which usually carries\n * the `Retry-After` the backoff already honours.\n */\n\n/**\n * The built-in retry policy, used when `retry` is `true` or is options carrying\n * no `shouldRetry` of their own.\n *\n * Conservative on purpose. Replaying a write can duplicate it, and replaying a\n * `400` or a `403` cannot fix a bad payload or a permission the caller does not\n * have — it only spends the user's time before showing the same error.\n *\n * @param error - Whatever the attempt threw.\n * @param method - The upper-cased HTTP method of the request.\n * @returns Whether the client should try again.\n */\nfunction isRetriableFailure(error: unknown, method: string): boolean {\n    if (!IDEMPOTENT_METHODS.has(method)) return false;\n    if (!(error instanceof TempestApiError)) return false;\n    return isRetriableStatus(error.status);\n}\n\n/**\n * Normalize the `retry` config into options, or `null` when retrying is off.\n *\n * @param config - The `retry` field as the caller wrote it.\n * @returns Retry options to use, or `null` to run a single attempt.\n */\nfunction resolveRetry(config: boolean | RetryOptions | undefined): RetryOptions | null {\n    if (!config) return null;\n    return config === true ? {} : config;\n}\n\n/** Default milliseconds before a request is abandoned. */\nconst DEFAULT_TIMEOUT = 15_000;\n\n/** Default milliseconds before a `FormData` request is abandoned. */\nconst DEFAULT_UPLOAD_TIMEOUT = 300_000;\n\nfunction isFormData(body: unknown): body is FormData {\n    return typeof FormData !== \"undefined\" && body instanceof FormData;\n}\n\n/**\n * Milliseconds since a `performance.now()` reading, rounded.\n *\n * `performance.now()` rather than `Date.now()` because this measures a\n * duration: the wall clock can step sideways mid-request (an NTP correction, a\n * VM resuming, the user changing the clock) and turn a 40 ms call into a\n * negative number. The monotonic clock cannot.\n *\n * @param startedAt - The reading taken before the work started.\n * @returns Whole milliseconds elapsed.\n */\nfunction elapsedMs(startedAt: number): number {\n    return Math.round(performance.now() - startedAt);\n}\n\nasync function parseError(response: Response, sentRequestId?: string): Promise<TempestApiError> {\n    let body: unknown;\n    try {\n        body = await response.clone().json();\n    } catch {\n        try {\n            body = await response.text();\n        } catch {\n            body = null;\n        }\n    }\n    return new TempestApiError(\n        buildApiError(response.status, body, response.headers, sentRequestId),\n    );\n}\n\n/**\n * Create a typed HTTP client backed by `fetch`.\n *\n * Handles JSON serialization, query params, bearer auth via `getToken`, uploads\n * via `FormData`, and throws a typed `ApiError` on any non-2xx response.\n *\n * **Expired sessions.** A `401` with `refresh` configured awaits the refresh and\n * replays the request once. `onUnauthorized` fires whenever that path ends\n * unauthorized anyway — the refresh threw, or the replay came back `401` — which\n * is the signal to clear the session. Without `refresh`, the first `401` calls\n * it directly.\n *\n * **Binary bodies** have their own methods — `blob()` and `arrayBuffer()` — which\n * run the same pipeline and skip the parse. `request()` no longer decodes an\n * unknown `Content-Type` as text either: it returns a `Blob` and says so once in\n * a development build, because reading `image/jpeg` as UTF-8 destroyed the bytes\n * on the way in.\n *\n * **The bearer token is scoped to `baseURL`'s origin** since 0.66.0. A path may\n * be an absolute URL, which overrides the base entirely, so without a scope the\n * destination of a credentialed request could come from a value read off the\n * network. A request to another origin still goes out; it goes without the\n * header, and a development build says so once. Declare the exceptions in\n * {@link ApiClientConfig.trustedOrigins}.\n *\n * **CSRF** is off unless you set `csrf`. With it, every unsafe request (anything\n * but `GET`/`HEAD`/`OPTIONS`/`TRACE`) echoes the `csrf_token` cookie in an\n * `X-CSRF-Token` header — the double-submit contract of `tempest-fastapi-sdk`'s\n * `CSRFMiddleware` — scoped to the same origins as the bearer token and sent on\n * `skipAuth` requests too. See {@link ApiClientConfig.csrf}.\n *\n * **Retries** are off unless you set `retry`. See {@link ApiClientConfig.retry}\n * for the built-in policy; it never replays a write. A single call overrides it\n * with {@link RequestOptions.retry}, and opts out of auth entirely with\n * {@link RequestOptions.skipAuth}.\n *\n * **Logging** is off unless you pass a `logger`. With one, every finished attempt\n * writes a line — `debug` under 400, `warn` from 400 up, plus a `warn` when\n * `onUnauthorized` fires — carrying `requestId`, `status` and elapsed `ms`, and\n * never a body, header or query string. The level and the destination belong to\n * the logger, not to a boolean here.\n *\n * @example\n * const api = createApiClient({\n *     baseURL: import.meta.env.VITE_API_URL,\n *     getToken: () => useAuthStore.getState().token,\n *     refresh,\n *     onUnauthorized: () => useAuthStore.getState().logout(),\n *     logger: createLogger({ level: import.meta.env.DEV ? \"debug\" : \"warn\" }).child(\"http\"),\n *     retry: true,\n * });\n *\n * @param config - Base URL plus the optional auth, retry and fetch hooks.\n * @returns A client with `request`/`get`/`post`/`put`/`patch`/`delete`/`blob`/\n * `arrayBuffer`/`upload`.\n */\nexport function createApiClient(config: ApiClientConfig): ApiClient {\n    const fetcher = config.fetcher ?? globalThis.fetch.bind(globalThis);\n\n    /**\n     * The `Authorization` header for a request, or nothing.\n     *\n     * Takes the resolved URL rather than reading `config.baseURL`, because an\n     * absolute path overrides the base entirely (see `buildApiUrl`) and the\n     * credential is scoped to an origin, not to a client.\n     *\n     * @param url - The absolute URL the request is going to.\n     * @param skipAuth - Whether the caller opted this request out of auth.\n     * @returns The header, or an empty object.\n     */\n    function authHeaders(url: string, skipAuth: boolean): Record<string, string> {\n        if (skipAuth) return {};\n        const token = config.getToken?.();\n        if (!token) return {};\n        if (!isTrustedCredentialTarget(url, config.baseURL, config.trustedOrigins)) {\n            reportSuppressedCredential(url, config.baseURL);\n            return {};\n        }\n        return { Authorization: `Bearer ${token}` };\n    }\n\n    async function rawRequest(\n        path: string,\n        options: RequestOptions,\n        requestId: string | undefined,\n        skipAuth: boolean,\n    ): Promise<Response> {\n        const { body, params, headers, signal, timeout, ...rest } = options;\n        const isForm = isFormData(body);\n        const configured = isForm ? config.uploadTimeout : config.timeout;\n        const fallback = isForm ? DEFAULT_UPLOAD_TIMEOUT : DEFAULT_TIMEOUT;\n        const limit =\n            timeout !== undefined ? timeout : configured !== undefined ? configured : fallback;\n\n        const url = buildApiUrl(config.baseURL, path, { prefix: config.prefix, params });\n\n        const callerHeaders = headers as Record<string, string> | undefined;\n        const finalHeaders: Record<string, string> = {\n            ...(isForm ? {} : { \"Content-Type\": \"application/json\" }),\n            ...(requestId ? { \"X-Request-ID\": requestId } : {}),\n            ...config.headers,\n            ...authHeaders(url, skipAuth),\n            ...csrfHeaders({\n                method: rest.method ?? \"GET\",\n                url,\n                reference: config.baseURL,\n                csrf: config.csrf,\n                trustedOrigins: config.trustedOrigins,\n                headers: { ...config.headers, ...callerHeaders },\n            }),\n            ...callerHeaders,\n        };\n\n        const timed = withTimeout(signal, limit);\n        const init: RequestInit = {\n            ...rest,\n            signal: timed.signal,\n            headers: finalHeaders,\n            credentials: config.withCredentials ? \"include\" : rest.credentials,\n            body:\n                body === undefined || body === null\n                    ? undefined\n                    : isForm\n                      ? (body as FormData)\n                      : JSON.stringify(body),\n        };\n\n        try {\n            return await fetcher(url, init);\n        } catch (cause) {\n            if (timed.timedOut()) {\n                throw new TempestApiError({\n                    status: 0,\n                    detail: `A requisição excedeu ${limit}ms e foi abandonada.`,\n                });\n            }\n            throw cause;\n        } finally {\n            timed.dispose();\n        }\n    }\n\n    async function send(\n        path: string,\n        options: RequestOptions,\n        requestId: string,\n        method: string,\n        skipAuth: boolean,\n    ): Promise<Response> {\n        const log = config.logger;\n        if (!log) return rawRequest(path, options, requestId, skipAuth);\n\n        const startedAt = performance.now();\n        try {\n            const response = await rawRequest(path, options, requestId, skipAuth);\n            const entry = { requestId, status: response.status, ms: elapsedMs(startedAt) };\n            const line = `${method} ${path} → ${response.status}`;\n            if (response.status >= 400) log.warn(line, entry);\n            else log.debug(line, entry);\n            return response;\n        } catch (error) {\n            log.warn(`${method} ${path} → no response`, {\n                requestId,\n                ms: elapsedMs(startedAt),\n                error,\n            });\n            throw error;\n        }\n    }\n\n    /**\n     * Call `onUnauthorized`, keeping the request's own error unless the hook\n     * says the attempt belongs to an ended session.\n     *\n     * @param response - The `401` that ended the attempt.\n     * @param requestId - Correlation id for the log.\n     * @param context - The credential and session the attempt left with.\n     * @throws {SessionSupersededError} When `onUnauthorized` threw it.\n     */\n    async function notifyUnauthorized(\n        response: Response,\n        requestId: string,\n        context: RequestAuthContext,\n    ): Promise<void> {\n        if (!config.onUnauthorized) return;\n        config.logger?.warn(`unauthorized — calling onUnauthorized`, {\n            requestId,\n            status: response.status,\n        });\n        try {\n            await config.onUnauthorized(response, context);\n        } catch (error) {\n            if (error instanceof SessionSupersededError) throw error;\n            config.logger?.warn(`onUnauthorized threw — keeping the original response error`, {\n                requestId,\n                status: response.status,\n                error,\n            });\n        }\n    }\n\n    /**\n     * The credential and session an attempt leaves with, read just before it is\n     * sent.\n     *\n     * @param skipAuth - Whether the attempt goes out without credentials.\n     * @returns The context handed to `refresh` and `onUnauthorized`.\n     */\n    function authContext(skipAuth: boolean): RequestAuthContext {\n        return {\n            token: skipAuth ? null : (config.getToken?.() ?? null),\n            epoch: config.getSessionEpoch?.() ?? null,\n        };\n    }\n\n    async function attempt<T>(\n        path: string,\n        options: RequestOptions,\n        decode: ResponseDecoder<T>,\n    ): Promise<T> {\n        const { skipAuth = false, skipAuthRetry = false, ...init } = options;\n        const requestId = config.requestId ? config.requestId() : randomId();\n        const method = (init.method ?? \"GET\").toUpperCase();\n        const sent = authContext(skipAuth);\n        let response = await send(path, init, requestId, method, skipAuth);\n\n        if (response.status === 401 && !skipAuth && !skipAuthRetry) {\n            if (config.refresh) {\n                let replayed: RequestAuthContext;\n                try {\n                    await config.refresh(sent);\n                    replayed = authContext(skipAuth);\n                    response = await send(path, init, requestId, method, skipAuth);\n                } catch (error) {\n                    if (error instanceof SessionSupersededError) throw error;\n                    await notifyUnauthorized(response, requestId, sent);\n                    throw await parseError(response, requestId);\n                }\n                if (response.status === 401) {\n                    await notifyUnauthorized(response, requestId, replayed);\n                }\n            } else {\n                await notifyUnauthorized(response, requestId, sent);\n            }\n        }\n\n        if (!response.ok) {\n            throw await parseError(response, requestId);\n        }\n\n        return decode(response);\n    }\n\n    async function run<T>(\n        path: string,\n        options: RequestOptions,\n        decode: ResponseDecoder<T>,\n    ): Promise<T> {\n        const { retry: perRequest, ...rest } = options;\n        const retryOptions = resolveRetry(perRequest !== undefined ? perRequest : config.retry);\n        if (!retryOptions) return attempt<T>(path, rest, decode);\n\n        const method = (rest.method ?? \"GET\").toUpperCase();\n        return retryWithBackoff(() => attempt<T>(path, rest, decode), {\n            ...retryOptions,\n            shouldRetry:\n                retryOptions.shouldRetry ?? ((error: unknown) => isRetriableFailure(error, method)),\n        });\n    }\n\n    async function request<T>(path: string, options: RequestOptions = {}): Promise<T> {\n        return run<T>(path, options, decodeByContentType);\n    }\n\n    async function upload<T>(\n        path: string,\n        formData: FormData,\n        method: \"POST\" | \"PUT\" | \"PATCH\" = \"POST\",\n        options?: Omit<RequestOptions, \"body\" | \"method\">,\n    ): Promise<T> {\n        return request<T>(path, { ...options, method, body: formData });\n    }\n\n    return {\n        request,\n        get: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"GET\" }),\n        post: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"POST\" }),\n        put: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"PUT\" }),\n        patch: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"PATCH\" }),\n        delete: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"DELETE\" }),\n        blob: (path: string, options?: RequestOptions) =>\n            run<Blob>(path, { ...options }, (response) => response.blob()),\n        arrayBuffer: (path: string, options?: RequestOptions) =>\n            run<ArrayBuffer>(path, { ...options }, (response) => response.arrayBuffer()),\n        upload,\n    };\n}\n"],"mappings":";;;;;;;;;AA8BA,IAAM,oBAA0C,IAAI,IAAI;CAAC;CAAO;CAAQ;AAAS,CAAC;AAoBlF,SAAS,EAAmB,GAAgB,GAAyB;CAGjE,OAFI,CAAC,EAAmB,IAAI,CAAM,KAC9B,EAAE,aAAiB,KAAyB,KACzC,EAAkB,EAAM,MAAM;AACzC;AAQA,SAAS,EAAa,GAAiE;CAEnF,OADK,IACE,MAAW,KAAO,CAAC,IAAI,IADV;AAExB;AAGA,IAAM,IAAkB,MAGlB,IAAyB;AAE/B,SAAS,EAAW,GAAiC;CACjD,OAAO,OAAO,WAAa,OAAe,aAAgB;AAC9D;AAaA,SAAS,EAAU,GAA2B;CAC1C,OAAO,KAAK,MAAM,YAAY,IAAI,IAAI,CAAS;AACnD;AAEA,eAAe,EAAW,GAAoB,GAAkD;CAC5F,IAAI;CACJ,IAAI;EACA,IAAO,MAAM,EAAS,MAAM,CAAC,CAAC,KAAK;CACvC,QAAQ;EACJ,IAAI;GACA,IAAO,MAAM,EAAS,KAAK;EAC/B,QAAQ;GACJ,IAAO;EACX;CACJ;CACA,OAAO,IAAI,EACP,EAAc,EAAS,QAAQ,GAAM,EAAS,SAAS,CAAa,CACxE;AACJ;AA0DA,SAAgB,EAAgB,GAAoC;CAChE,IAAM,IAAU,EAAO,WAAW,WAAW,MAAM,KAAK,UAAU;CAalE,SAAS,EAAY,GAAa,GAA2C;EACzE,IAAI,GAAU,OAAO,CAAC;EACtB,IAAM,IAAQ,EAAO,WAAW;EAMhC,OALK,IACA,EAA0B,GAAK,EAAO,SAAS,EAAO,cAAc,IAIlE,EAAE,eAAe,UAAU,IAAQ,KAHtC,EAA2B,GAAK,EAAO,OAAO,GACvC,CAAC,KAHO,CAAC;CAMxB;CAEA,eAAe,EACX,GACA,GACA,GACA,GACiB;EACjB,IAAM,EAAE,SAAM,WAAQ,YAAS,WAAQ,YAAS,GAAG,MAAS,GACtD,IAAS,EAAW,CAAI,GACxB,IAAa,IAAS,EAAO,gBAAgB,EAAO,SAEpD,IACF,MAAY,KAAA,IAAsB,MAAe,KAAA,IAFpC,IAAS,IAAyB,IAEc,IAArC,GAEtB,IAAM,EAAY,EAAO,SAAS,GAAM;GAAE,QAAQ,EAAO;GAAQ;EAAO,CAAC,GAEzE,IAAgB,GAChB,IAAuC;GACzC,GAAI,IAAS,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;GACvD,GAAI,IAAY,EAAE,gBAAgB,EAAU,IAAI,CAAC;GACjD,GAAG,EAAO;GACV,GAAG,EAAY,GAAK,CAAQ;GAC5B,GAAG,EAAY;IACX,QAAQ,EAAK,UAAU;IACvB;IACA,WAAW,EAAO;IAClB,MAAM,EAAO;IACb,gBAAgB,EAAO;IACvB,SAAS;KAAE,GAAG,EAAO;KAAS,GAAG;IAAc;GACnD,CAAC;GACD,GAAG;EACP,GAEM,IAAQ,EAAY,GAAQ,CAAK,GACjC,IAAoB;GACtB,GAAG;GACH,QAAQ,EAAM;GACd,SAAS;GACT,aAAa,EAAO,kBAAkB,YAAY,EAAK;GACvD,MACI,KAA+B,OACzB,KAAA,IACA,IACG,IACD,KAAK,UAAU,CAAI;EACnC;EAEA,IAAI;GACA,OAAO,MAAM,EAAQ,GAAK,CAAI;EAClC,SAAS,GAAO;GAOZ,MANI,EAAM,SAAS,IACT,IAAI,EAAgB;IACtB,QAAQ;IACR,QAAQ,wBAAwB,EAAM;GAC1C,CAAC,IAEC;EACV,UAAU;GACN,EAAM,QAAQ;EAClB;CACJ;CAEA,eAAe,EACX,GACA,GACA,GACA,GACA,GACiB;EACjB,IAAM,IAAM,EAAO;EACnB,IAAI,CAAC,GAAK,OAAO,EAAW,GAAM,GAAS,GAAW,CAAQ;EAE9D,IAAM,IAAY,YAAY,IAAI;EAClC,IAAI;GACA,IAAM,IAAW,MAAM,EAAW,GAAM,GAAS,GAAW,CAAQ,GAC9D,IAAQ;IAAE;IAAW,QAAQ,EAAS;IAAQ,IAAI,EAAU,CAAS;GAAE,GACvE,IAAO,GAAG,EAAO,GAAG,EAAK,KAAK,EAAS;GAG7C,OAFI,EAAS,UAAU,MAAK,EAAI,KAAK,GAAM,CAAK,IAC3C,EAAI,MAAM,GAAM,CAAK,GACnB;EACX,SAAS,GAAO;GAMZ,MALA,EAAI,KAAK,GAAG,EAAO,GAAG,EAAK,iBAAiB;IACxC;IACA,IAAI,EAAU,CAAS;IACvB;GACJ,CAAC,GACK;EACV;CACJ;CAWA,eAAe,EACX,GACA,GACA,GACa;EACR,MAAO,gBACZ;KAAO,QAAQ,KAAK,yCAAyC;IACzD;IACA,QAAQ,EAAS;GACrB,CAAC;GACD,IAAI;IACA,MAAM,EAAO,eAAe,GAAU,CAAO;GACjD,SAAS,GAAO;IACZ,IAAI,aAAiB,GAAwB,MAAM;IACnD,EAAO,QAAQ,KAAK,8DAA8D;KAC9E;KACA,QAAQ,EAAS;KACjB;IACJ,CAAC;GACL;EAVC;CAWL;CASA,SAAS,EAAY,GAAuC;EACxD,OAAO;GACH,OAAO,IAAW,OAAQ,EAAO,WAAW,KAAK;GACjD,OAAO,EAAO,kBAAkB,KAAK;EACzC;CACJ;CAEA,eAAe,EACX,GACA,GACA,GACU;EACV,IAAM,EAAE,cAAW,IAAO,mBAAgB,IAAO,GAAG,MAAS,GACvD,IAAY,EAAO,YAAY,EAAO,UAAU,IAAI,EAAS,GAC7D,KAAU,EAAK,UAAU,MAAA,CAAO,YAAY,GAC5C,IAAO,EAAY,CAAQ,GAC7B,IAAW,MAAM,EAAK,GAAM,GAAM,GAAW,GAAQ,CAAQ;EAEjE,IAAI,EAAS,WAAW,OAAO,CAAC,KAAY,CAAC,GAAe;GACxD,IAAI,EAAO,SAAS;IAChB,IAAI;IACJ,IAAI;KAGA,AAFA,MAAM,EAAO,QAAQ,CAAI,GACzB,IAAW,EAAY,CAAQ,GAC/B,IAAW,MAAM,EAAK,GAAM,GAAM,GAAW,GAAQ,CAAQ;IACjE,SAAS,GAAO;KAGZ,MAFI,aAAiB,IAA8B,KACnD,MAAM,EAAmB,GAAU,GAAW,CAAI,GAC5C,MAAM,EAAW,GAAU,CAAS;IAC9C;IACA,AAAI,EAAS,WAAW,OACpB,MAAM,EAAmB,GAAU,GAAW,CAAQ;GAE9D,OACI,MAAM,EAAmB,GAAU,GAAW,CAAI;EAE1D;EAEA,IAAI,CAAC,EAAS,IACV,MAAM,MAAM,EAAW,GAAU,CAAS;EAG9C,OAAO,EAAO,CAAQ;CAC1B;CAEA,eAAe,EACX,GACA,GACA,GACU;EACV,IAAM,EAAE,OAAO,GAAY,GAAG,MAAS,GACjC,IAAe,EAAa,MAAe,KAAA,IAAyB,EAAO,QAApB,CAAyB;EACtF,IAAI,CAAC,GAAc,OAAO,EAAW,GAAM,GAAM,CAAM;EAEvD,IAAM,KAAU,EAAK,UAAU,MAAA,CAAO,YAAY;EAClD,OAAO,QAAuB,EAAW,GAAM,GAAM,CAAM,GAAG;GAC1D,GAAG;GACH,aACI,EAAa,iBAAiB,MAAmB,EAAmB,GAAO,CAAM;EACzF,CAAC;CACL;CAEA,eAAe,EAAW,GAAc,IAA0B,CAAC,GAAe;EAC9E,OAAO,EAAO,GAAM,GAAS,CAAmB;CACpD;CAEA,eAAe,EACX,GACA,GACA,IAAmC,QACnC,GACU;EACV,OAAO,EAAW,GAAM;GAAE,GAAG;GAAS;GAAQ,MAAM;EAAS,CAAC;CAClE;CAEA,OAAO;EACH;EACA,MAAS,GAAc,MACnB,EAAW,GAAM;GAAE,GAAG;GAAS,QAAQ;EAAM,CAAC;EAClD,OAAU,GAAc,MACpB,EAAW,GAAM;GAAE,GAAG;GAAS,QAAQ;EAAO,CAAC;EACnD,MAAS,GAAc,MACnB,EAAW,GAAM;GAAE,GAAG;GAAS,QAAQ;EAAM,CAAC;EAClD,QAAW,GAAc,MACrB,EAAW,GAAM;GAAE,GAAG;GAAS,QAAQ;EAAQ,CAAC;EACpD,SAAY,GAAc,MACtB,EAAW,GAAM;GAAE,GAAG;GAAS,QAAQ;EAAS,CAAC;EACrD,OAAO,GAAc,MACjB,EAAU,GAAM,EAAE,GAAG,EAAQ,IAAI,MAAa,EAAS,KAAK,CAAC;EACjE,cAAc,GAAc,MACxB,EAAiB,GAAM,EAAE,GAAG,EAAQ,IAAI,MAAa,EAAS,YAAY,CAAC;EAC/E;CACJ;AACJ"}
+{"version":3,"file":"api-client.js","names":["retryWithBackoff","IDEMPOTENT_METHODS","isRetriableFailure","method","error","TempestApiError","isRetriableStatus","resolveRetry","config","DEFAULT_TIMEOUT","DEFAULT_UPLOAD_TIMEOUT","isFormData","body","elapsedMs","startedAt","parseError","response","buildApiError","sentRequestId","createApiClient","fetcher","authHeaders","skipAuth","token","isTrustedCredentialTarget","url","reportSuppressedCredential","rawRequest","rest","options","isForm","configured","limit","timeout","buildApiUrl","path","callerHeaders","headers","finalHeaders","requestId","csrfHeaders","timed","withTimeout","signal","init","cause","send","log","entry","line","notifyUnauthorized","context","SessionSupersededError","authContext","attempt","randomId","sent","skipAuthRetry","replayed","decode","run","perRequest","retryOptions","retry","request","decodeByContentType","upload","formData"],"sources":["../../src/http/api-client.ts"],"sourcesContent":["/**\n * @tempest-limits function-lines — createApiClient is over the limit and every line\n * is a request-lifecycle concern the client cannot delegate: base URL joining, the\n * auth header, the 401 refresh-and-replay, the opt-in retry wrapper and the response\n * parsing that turns a failure into a typed error.\n */\nimport { randomId } from \"../utils\";\nimport { buildApiUrl } from \"./build-url\";\nimport { isTrustedCredentialTarget, reportSuppressedCredential } from \"./credential-scope\";\nimport { csrfHeaders } from \"./csrf\";\nimport { decodeByContentType } from \"./decode-response\";\nimport type { ResponseDecoder } from \"./decode-response\";\nimport {\n    buildApiError,\n    SessionSupersededError,\n    TempestApiError,\n    isRetriableStatus,\n} from \"./errors\";\nimport { retry as retryWithBackoff } from \"./retry\";\nimport type { RetryOptions } from \"./retry\";\nimport { withTimeout } from \"./timeout\";\nimport type { ApiClient, ApiClientConfig, RequestAuthContext, RequestOptions } from \"./types\";\n\n/**\n * Methods the built-in retry policy will replay.\n *\n * `PUT` and `DELETE` are idempotent on paper but stay out: a backend that logs,\n * bills, or fires a webhook per call still sees two, so replaying them is a\n * decision the caller makes through `shouldRetry`, not a default.\n */\nconst IDEMPOTENT_METHODS: ReadonlySet<string> = new Set([\"GET\", \"HEAD\", \"OPTIONS\"]);\n\n/**\n * Sub-500 statuses worth a second attempt: a network failure (status `0`), a\n * request timeout, a too-early replay, and a rate limit — which usually carries\n * the `Retry-After` the backoff already honours.\n */\n\n/**\n * The built-in retry policy, used when `retry` is `true` or is options carrying\n * no `shouldRetry` of their own.\n *\n * Conservative on purpose. Replaying a write can duplicate it, and replaying a\n * `400` or a `403` cannot fix a bad payload or a permission the caller does not\n * have — it only spends the user's time before showing the same error.\n *\n * @param error - Whatever the attempt threw.\n * @param method - The upper-cased HTTP method of the request.\n * @returns Whether the client should try again.\n */\nfunction isRetriableFailure(error: unknown, method: string): boolean {\n    if (!IDEMPOTENT_METHODS.has(method)) return false;\n    if (!(error instanceof TempestApiError)) return false;\n    return isRetriableStatus(error.status);\n}\n\n/**\n * Normalize the `retry` config into options, or `null` when retrying is off.\n *\n * @param config - The `retry` field as the caller wrote it.\n * @returns Retry options to use, or `null` to run a single attempt.\n */\nfunction resolveRetry(config: boolean | RetryOptions | undefined): RetryOptions | null {\n    if (!config) return null;\n    return config === true ? {} : config;\n}\n\n/** Default milliseconds before a request is abandoned. */\nconst DEFAULT_TIMEOUT = 15_000;\n\n/** Default milliseconds before a `FormData` request is abandoned. */\nconst DEFAULT_UPLOAD_TIMEOUT = 300_000;\n\nfunction isFormData(body: unknown): body is FormData {\n    return typeof FormData !== \"undefined\" && body instanceof FormData;\n}\n\n/**\n * Milliseconds since a `performance.now()` reading, rounded.\n *\n * `performance.now()` rather than `Date.now()` because this measures a\n * duration: the wall clock can step sideways mid-request (an NTP correction, a\n * VM resuming, the user changing the clock) and turn a 40 ms call into a\n * negative number. The monotonic clock cannot.\n *\n * @param startedAt - The reading taken before the work started.\n * @returns Whole milliseconds elapsed.\n */\nfunction elapsedMs(startedAt: number): number {\n    return Math.round(performance.now() - startedAt);\n}\n\nasync function parseError(response: Response, sentRequestId?: string): Promise<TempestApiError> {\n    let body: unknown;\n    try {\n        body = await response.clone().json();\n    } catch {\n        try {\n            body = await response.text();\n        } catch {\n            body = null;\n        }\n    }\n    return new TempestApiError(\n        buildApiError(response.status, body, response.headers, sentRequestId),\n    );\n}\n\n/**\n * Create a typed HTTP client backed by `fetch`.\n *\n * Handles JSON serialization, query params, bearer auth via `getToken`, uploads\n * via `FormData`, and throws a typed `ApiError` on any non-2xx response.\n *\n * **Expired sessions.** A `401` with `refresh` configured awaits the refresh and\n * replays the request once. `onUnauthorized` fires whenever that path ends\n * unauthorized anyway — the refresh threw, or the replay came back `401` — which\n * is the signal to clear the session. Without `refresh`, the first `401` calls\n * it directly.\n *\n * **Binary bodies** have their own methods — `blob()` and `arrayBuffer()` — which\n * run the same pipeline and skip the parse. `request()` no longer decodes an\n * unknown `Content-Type` as text either: it returns a `Blob` and says so once in\n * a development build, because reading `image/jpeg` as UTF-8 destroyed the bytes\n * on the way in.\n *\n * **The bearer token is scoped to `baseURL`'s origin** since 0.66.0. A path may\n * be an absolute URL, which overrides the base entirely, so without a scope the\n * destination of a credentialed request could come from a value read off the\n * network. A request to another origin still goes out; it goes without the\n * header, and a development build says so once. Declare the exceptions in\n * {@link ApiClientConfig.trustedOrigins}.\n *\n * **CSRF** is off unless you set `csrf`. With it, every unsafe request (anything\n * but `GET`/`HEAD`/`OPTIONS`/`TRACE`) echoes the `csrf_token` cookie in an\n * `X-CSRF-Token` header — the double-submit contract of `tempest-fastapi-sdk`'s\n * `CSRFMiddleware` — scoped to the same origins as the bearer token and sent on\n * `skipAuth` requests too. See {@link ApiClientConfig.csrf}.\n *\n * **Retries** are off unless you set `retry`. See {@link ApiClientConfig.retry}\n * for the built-in policy; it never replays a write. A single call overrides it\n * with {@link RequestOptions.retry}, and opts out of auth entirely with\n * {@link RequestOptions.skipAuth}.\n *\n * **Logging** is off unless you pass a `logger`. With one, every finished attempt\n * writes a line — `debug` under 400, `warn` from 400 up, plus a `warn` when\n * `onUnauthorized` fires — carrying `requestId`, `status` and elapsed `ms`, and\n * never a body, header or query string. The level and the destination belong to\n * the logger, not to a boolean here.\n *\n * @example\n * const api = createApiClient({\n *     baseURL: import.meta.env.VITE_API_URL,\n *     getToken: () => useAuthStore.getState().token,\n *     refresh,\n *     onUnauthorized: () => useAuthStore.getState().logout(),\n *     logger: createLogger({ level: import.meta.env.DEV ? \"debug\" : \"warn\" }).child(\"http\"),\n *     retry: true,\n * });\n *\n * @param config - Base URL plus the optional auth, retry and fetch hooks.\n * @returns A client with `request`/`get`/`post`/`put`/`patch`/`delete`/`blob`/\n * `arrayBuffer`/`upload`.\n */\nexport function createApiClient(config: ApiClientConfig): ApiClient {\n    const fetcher = config.fetcher ?? globalThis.fetch.bind(globalThis);\n\n    /**\n     * The `Authorization` header for a request, or nothing.\n     *\n     * Takes the resolved URL rather than reading `config.baseURL`, because an\n     * absolute path overrides the base entirely (see `buildApiUrl`) and the\n     * credential is scoped to an origin, not to a client.\n     *\n     * @param url - The absolute URL the request is going to.\n     * @param skipAuth - Whether the caller opted this request out of auth.\n     * @returns The header, or an empty object.\n     */\n    function authHeaders(url: string, skipAuth: boolean): Record<string, string> {\n        if (skipAuth) return {};\n        const token = config.getToken?.();\n        if (!token) return {};\n        if (!isTrustedCredentialTarget(url, config.baseURL, config.trustedOrigins)) {\n            reportSuppressedCredential(url, config.baseURL);\n            return {};\n        }\n        return { Authorization: `Bearer ${token}` };\n    }\n\n    async function rawRequest(\n        path: string,\n        options: RequestOptions,\n        requestId: string | undefined,\n        skipAuth: boolean,\n    ): Promise<Response> {\n        const { body, params, headers, signal, timeout, ...rest } = options;\n        const isForm = isFormData(body);\n        const configured = isForm ? config.uploadTimeout : config.timeout;\n        const fallback = isForm ? DEFAULT_UPLOAD_TIMEOUT : DEFAULT_TIMEOUT;\n        const limit =\n            timeout !== undefined ? timeout : configured !== undefined ? configured : fallback;\n\n        const url = buildApiUrl(config.baseURL, path, { prefix: config.prefix, params });\n\n        const callerHeaders = headers as Record<string, string> | undefined;\n        const finalHeaders: Record<string, string> = {\n            ...(isForm ? {} : { \"Content-Type\": \"application/json\" }),\n            ...(requestId ? { \"X-Request-ID\": requestId } : {}),\n            ...config.headers,\n            ...authHeaders(url, skipAuth),\n            ...csrfHeaders({\n                method: rest.method ?? \"GET\",\n                url,\n                reference: config.baseURL,\n                csrf: config.csrf,\n                trustedOrigins: config.trustedOrigins,\n                headers: { ...config.headers, ...callerHeaders },\n            }),\n            ...callerHeaders,\n        };\n\n        const timed = withTimeout(signal, limit);\n        const init: RequestInit = {\n            ...rest,\n            signal: timed.signal,\n            headers: finalHeaders,\n            credentials: config.withCredentials ? \"include\" : rest.credentials,\n            body:\n                body === undefined || body === null\n                    ? undefined\n                    : isForm\n                      ? (body as FormData)\n                      : JSON.stringify(body),\n        };\n\n        try {\n            return await fetcher(url, init);\n        } catch (cause) {\n            if (timed.timedOut()) {\n                throw new TempestApiError({\n                    status: 0,\n                    detail: `A requisição excedeu ${limit}ms e foi abandonada.`,\n                });\n            }\n            throw cause;\n        } finally {\n            timed.dispose();\n        }\n    }\n\n    async function send(\n        path: string,\n        options: RequestOptions,\n        requestId: string,\n        method: string,\n        skipAuth: boolean,\n    ): Promise<Response> {\n        const log = config.logger;\n        if (!log) return rawRequest(path, options, requestId, skipAuth);\n\n        const startedAt = performance.now();\n        try {\n            const response = await rawRequest(path, options, requestId, skipAuth);\n            const entry = { requestId, status: response.status, ms: elapsedMs(startedAt) };\n            const line = `${method} ${path} → ${response.status}`;\n            if (response.status >= 400) log.warn(line, entry);\n            else log.debug(line, entry);\n            return response;\n        } catch (error) {\n            log.warn(`${method} ${path} → no response`, {\n                requestId,\n                ms: elapsedMs(startedAt),\n                error,\n            });\n            throw error;\n        }\n    }\n\n    /**\n     * Call `onUnauthorized`, keeping the request's own error unless the hook\n     * says the attempt belongs to an ended session.\n     *\n     * @param response - The `401` that ended the attempt.\n     * @param requestId - Correlation id for the log.\n     * @param context - The credential and session the attempt left with.\n     * @throws {SessionSupersededError} When `onUnauthorized` threw it.\n     */\n    async function notifyUnauthorized(\n        response: Response,\n        requestId: string,\n        context: RequestAuthContext,\n    ): Promise<void> {\n        if (!config.onUnauthorized) return;\n        config.logger?.warn(`unauthorized — calling onUnauthorized`, {\n            requestId,\n            status: response.status,\n        });\n        try {\n            await config.onUnauthorized(response, context);\n        } catch (error) {\n            if (error instanceof SessionSupersededError) throw error;\n            config.logger?.warn(`onUnauthorized threw — keeping the original response error`, {\n                requestId,\n                status: response.status,\n                error,\n            });\n        }\n    }\n\n    /**\n     * The credential and session an attempt leaves with, read just before it is\n     * sent.\n     *\n     * @param skipAuth - Whether the attempt goes out without credentials.\n     * @returns The context handed to `refresh` and `onUnauthorized`.\n     */\n    function authContext(skipAuth: boolean): RequestAuthContext {\n        return {\n            token: skipAuth ? null : (config.getToken?.() ?? null),\n            epoch: config.getSessionEpoch?.() ?? null,\n        };\n    }\n\n    async function attempt<T>(\n        path: string,\n        options: RequestOptions,\n        decode: ResponseDecoder<T>,\n    ): Promise<T> {\n        const { skipAuth = false, skipAuthRetry = false, ...init } = options;\n        const requestId = config.requestId ? config.requestId() : randomId();\n        const method = (init.method ?? \"GET\").toUpperCase();\n        const sent = authContext(skipAuth);\n        let response = await send(path, init, requestId, method, skipAuth);\n\n        if (response.status === 401 && !skipAuth && !skipAuthRetry) {\n            if (config.refresh) {\n                let replayed: RequestAuthContext;\n                try {\n                    await config.refresh(sent);\n                    replayed = authContext(skipAuth);\n                    response = await send(path, init, requestId, method, skipAuth);\n                } catch (error) {\n                    if (error instanceof SessionSupersededError) throw error;\n                    await notifyUnauthorized(response, requestId, sent);\n                    throw await parseError(response, requestId);\n                }\n                if (response.status === 401) {\n                    await notifyUnauthorized(response, requestId, replayed);\n                }\n            } else {\n                await notifyUnauthorized(response, requestId, sent);\n            }\n        }\n\n        if (!response.ok) {\n            throw await parseError(response, requestId);\n        }\n\n        return decode(response);\n    }\n\n    async function run<T>(\n        path: string,\n        options: RequestOptions,\n        decode: ResponseDecoder<T>,\n    ): Promise<T> {\n        const { retry: perRequest, ...rest } = options;\n        const retryOptions = resolveRetry(perRequest !== undefined ? perRequest : config.retry);\n        if (!retryOptions) return attempt<T>(path, rest, decode);\n\n        const method = (rest.method ?? \"GET\").toUpperCase();\n        return retryWithBackoff(() => attempt<T>(path, rest, decode), {\n            ...retryOptions,\n            shouldRetry:\n                retryOptions.shouldRetry ?? ((error: unknown) => isRetriableFailure(error, method)),\n        });\n    }\n\n    async function request<T>(path: string, options: RequestOptions = {}): Promise<T> {\n        return run<T>(path, options, decodeByContentType);\n    }\n\n    async function upload<T>(\n        path: string,\n        formData: FormData,\n        method: \"POST\" | \"PUT\" | \"PATCH\" = \"POST\",\n        options?: Omit<RequestOptions, \"body\" | \"method\">,\n    ): Promise<T> {\n        return request<T>(path, { ...options, method, body: formData });\n    }\n\n    return {\n        request,\n        get: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"GET\" }),\n        post: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"POST\" }),\n        put: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"PUT\" }),\n        patch: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"PATCH\" }),\n        delete: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"DELETE\" }),\n        blob: (path: string, options?: RequestOptions) =>\n            run<Blob>(path, { ...options }, (response) => response.blob()),\n        arrayBuffer: (path: string, options?: RequestOptions) =>\n            run<ArrayBuffer>(path, { ...options }, (response) => response.arrayBuffer()),\n        upload,\n        url: (path: string, params?: RequestOptions[\"params\"]) =>\n            buildApiUrl(config.baseURL, path, { prefix: config.prefix, params }),\n    };\n}\n"],"mappings":";;;;;;;;;AA8BA,IAAMC,oBAA0C,IAAI,IAAI;CAAC;CAAO;CAAQ;AAAS,CAAC;AAoBlF,SAASC,EAAmB,GAAgB,GAAyB;CAGjE,OAFI,CAACD,EAAmB,IAAIE,CAAM,KAC9B,EAAEC,aAAiBC,KAAyB,KACzCC,EAAkBF,EAAM,MAAM;AACzC;AAQA,SAASG,EAAa,GAAiE;CAEnF,OADKC,IACEA,MAAW,KAAO,CAAC,IAAIA,IADV;AAExB;AAGA,IAAMC,IAAkB,MAGlBC,IAAyB;AAE/B,SAASC,EAAW,GAAiC;CACjD,OAAO,OAAO,WAAa,OAAeC,aAAgB;AAC9D;AAaA,SAASC,EAAU,GAA2B;CAC1C,OAAO,KAAK,MAAM,YAAY,IAAI,IAAIC,CAAS;AACnD;AAEA,eAAeC,EAAW,GAAoB,GAAkD;CAC5F,IAAIH;CACJ,IAAI;EACA,IAAO,MAAMI,EAAS,MAAM,CAAC,CAAC,KAAK;CACvC,QAAQ;EACJ,IAAI;GACA,IAAO,MAAMA,EAAS,KAAK;EAC/B,QAAQ;GACJ,IAAO;EACX;CACJ;CACA,OAAO,IAAIX,EACPY,EAAcD,EAAS,QAAQJ,GAAMI,EAAS,SAASE,CAAa,CACxE;AACJ;AA0DA,SAAgBC,EAAgB,GAAoC;CAChE,IAAMC,IAAUZ,EAAO,WAAW,WAAW,MAAM,KAAK,UAAU;CAalE,SAASa,EAAY,GAAa,GAA2C;EACzE,IAAIC,GAAU,OAAO,CAAC;EACtB,IAAMC,IAAQf,EAAO,WAAW;EAMhC,OALKe,IACAC,EAA0BC,GAAKjB,EAAO,SAASA,EAAO,cAAc,IAIlE,EAAE,eAAe,UAAUe,IAAQ,KAHtCG,EAA2BD,GAAKjB,EAAO,OAAO,GACvC,CAAC,KAHO,CAAC;CAMxB;CAEA,eAAemB,EACX,GACA,GACA,GACA,GACiB;EACjB,IAAM,EAAE,SAAM,WAAQ,YAAS,WAAQ,YAAS,GAAGC,MAASC,GACtDC,IAASnB,EAAWC,CAAI,GACxBmB,IAAaD,IAAStB,EAAO,gBAAgBA,EAAO,SAEpDwB,IACFC,MAAY,KAAA,IAAsBF,MAAe,KAAA,IAFpCD,IAASpB,IAAyBD,IAEcsB,IAArCE,GAEtBR,IAAMS,EAAY1B,EAAO,SAAS2B,GAAM;GAAE,QAAQ3B,EAAO;GAAQ;EAAO,CAAC,GAEzE4B,IAAgBC,GAChBC,IAAuC;GACzC,GAAIR,IAAS,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;GACvD,GAAIS,IAAY,EAAE,gBAAgBA,EAAU,IAAI,CAAC;GACjD,GAAG/B,EAAO;GACV,GAAGa,EAAYI,GAAKH,CAAQ;GAC5B,GAAGkB,EAAY;IACX,QAAQZ,EAAK,UAAU;IACvB;IACA,WAAWpB,EAAO;IAClB,MAAMA,EAAO;IACb,gBAAgBA,EAAO;IACvB,SAAS;KAAE,GAAGA,EAAO;KAAS,GAAG4B;IAAc;GACnD,CAAC;GACD,GAAGA;EACP,GAEMK,IAAQC,EAAYC,GAAQX,CAAK,GACjCY,IAAoB;GACtB,GAAGhB;GACH,QAAQa,EAAM;GACd,SAASH;GACT,aAAa9B,EAAO,kBAAkB,YAAYoB,EAAK;GACvD,MACIhB,KAA+B,OACzB,KAAA,IACAkB,IACGlB,IACD,KAAK,UAAUA,CAAI;EACnC;EAEA,IAAI;GACA,OAAO,MAAMQ,EAAQK,GAAKmB,CAAI;EAClC,SAASC,GAAO;GAOZ,MANIJ,EAAM,SAAS,IACT,IAAIpC,EAAgB;IACtB,QAAQ;IACR,QAAQ,wBAAwB2B,EAAM;GAC1C,CAAC,IAECa;EACV,UAAU;GACN,EAAM,QAAQ;EAClB;CACJ;CAEA,eAAeC,EACX,GACA,GACA,GACA,GACA,GACiB;EACjB,IAAMC,IAAMvC,EAAO;EACnB,IAAI,CAACuC,GAAK,OAAOpB,EAAWQ,GAAMN,GAASU,GAAWjB,CAAQ;EAE9D,IAAMR,IAAY,YAAY,IAAI;EAClC,IAAI;GACA,IAAME,IAAW,MAAMW,EAAWQ,GAAMN,GAASU,GAAWjB,CAAQ,GAC9D0B,IAAQ;IAAE;IAAW,QAAQhC,EAAS;IAAQ,IAAIH,EAAUC,CAAS;GAAE,GACvEmC,IAAO,GAAG9C,EAAO,GAAGgC,EAAK,KAAKnB,EAAS;GAG7C,OAFIA,EAAS,UAAU,MAAK+B,EAAI,KAAKE,GAAMD,CAAK,IAC3CD,EAAI,MAAME,GAAMD,CAAK,GACnBhC;EACX,SAASZ,GAAO;GAMZ,MALA2C,EAAI,KAAK,GAAG5C,EAAO,GAAGgC,EAAK,iBAAiB;IACxC;IACA,IAAItB,EAAUC,CAAS;IACvB;GACJ,CAAC,GACKV;EACV;CACJ;CAWA,eAAe8C,EACX,GACA,GACA,GACa;EACb,IAAK1C,EAAO,gBACZ;KAAO,QAAQ,KAAK,yCAAyC;IACzD;IACA,QAAQQ,EAAS;GACrB,CAAC;GACD,IAAI;IACA,MAAMR,EAAO,eAAeQ,GAAUmC,CAAO;GACjD,SAAS/C,GAAO;IACZ,IAAIA,aAAiBgD,GAAwB,MAAMhD;IACnD,EAAO,QAAQ,KAAK,8DAA8D;KAC9E;KACA,QAAQY,EAAS;KACjB;IACJ,CAAC;GACL;EAVC;CAWL;CASA,SAASqC,EAAY,GAAuC;EACxD,OAAO;GACH,OAAO/B,IAAW,OAAQd,EAAO,WAAW,KAAK;GACjD,OAAOA,EAAO,kBAAkB,KAAK;EACzC;CACJ;CAEA,eAAe8C,EACX,GACA,GACA,GACU;EACV,IAAM,EAAE,cAAW,IAAO,mBAAgB,IAAO,GAAGV,MAASf,GACvDU,IAAY/B,EAAO,YAAYA,EAAO,UAAU,IAAI+C,EAAS,GAC7DpD,KAAUyC,EAAK,UAAU,MAAA,CAAO,YAAY,GAC5CY,IAAOH,EAAY/B,CAAQ,GAC7BN,IAAW,MAAM8B,EAAKX,GAAMS,GAAML,GAAWpC,GAAQmB,CAAQ;EAEjE,IAAIN,EAAS,WAAW,OAAO,CAACM,KAAY,CAACmC,GAAe;GACxD,IAAIjD,EAAO,SAAS;IAChB,IAAIkD;IACJ,IAAI;KAGA,AAFA,MAAMlD,EAAO,QAAQgD,CAAI,GACzB,IAAWH,EAAY/B,CAAQ,GAC/B,IAAW,MAAMwB,EAAKX,GAAMS,GAAML,GAAWpC,GAAQmB,CAAQ;IACjE,SAASlB,GAAO;KAGZ,MAFIA,aAAiBgD,IAA8BhD,KACnD,MAAM8C,EAAmBlC,GAAUuB,GAAWiB,CAAI,GAC5C,MAAMzC,EAAWC,GAAUuB,CAAS;IAC9C;IACA,AAAIvB,EAAS,WAAW,OACpB,MAAMkC,EAAmBlC,GAAUuB,GAAWmB,CAAQ;GAE9D,OACI,MAAMR,EAAmBlC,GAAUuB,GAAWiB,CAAI;EAE1D;EAEA,IAAI,CAACxC,EAAS,IACV,MAAM,MAAMD,EAAWC,GAAUuB,CAAS;EAG9C,OAAOoB,EAAO3C,CAAQ;CAC1B;CAEA,eAAe4C,EACX,GACA,GACA,GACU;EACV,IAAM,EAAE,OAAOC,GAAY,GAAGjC,MAASC,GACjCiC,IAAevD,EAAasD,MAAe,KAAA,IAAyBrD,EAAO,QAApBqD,CAAyB;EACtF,IAAI,CAACC,GAAc,OAAOR,EAAWnB,GAAMP,GAAM+B,CAAM;EAEvD,IAAMxD,KAAUyB,EAAK,UAAU,MAAA,CAAO,YAAY;EAClD,OAAO5B,QAAuBsD,EAAWnB,GAAMP,GAAM+B,CAAM,GAAG;GAC1D,GAAGG;GACH,aACIA,EAAa,iBAAiB,MAAmB5D,EAAmBE,GAAOD,CAAM;EACzF,CAAC;CACL;CAEA,eAAe6D,EAAW,GAAc,IAA0B,CAAC,GAAe;EAC9E,OAAOJ,EAAOzB,GAAMN,GAASoC,CAAmB;CACpD;CAEA,eAAeC,EACX,GACA,GACA,IAAmC,QACnC,GACU;EACV,OAAOF,EAAW7B,GAAM;GAAE,GAAGN;GAAS;GAAQ,MAAMsC;EAAS,CAAC;CAClE;CAEA,OAAO;EACH;EACA,MAAS,GAAc,MACnBH,EAAW7B,GAAM;GAAE,GAAGN;GAAS,QAAQ;EAAM,CAAC;EAClD,OAAU,GAAc,MACpBmC,EAAW7B,GAAM;GAAE,GAAGN;GAAS,QAAQ;EAAO,CAAC;EACnD,MAAS,GAAc,MACnBmC,EAAW7B,GAAM;GAAE,GAAGN;GAAS,QAAQ;EAAM,CAAC;EAClD,QAAW,GAAc,MACrBmC,EAAW7B,GAAM;GAAE,GAAGN;GAAS,QAAQ;EAAQ,CAAC;EACpD,SAAY,GAAc,MACtBmC,EAAW7B,GAAM;GAAE,GAAGN;GAAS,QAAQ;EAAS,CAAC;EACrD,OAAO,GAAc,MACjB+B,EAAUzB,GAAM,EAAE,GAAGN,EAAQ,IAAI,MAAab,EAAS,KAAK,CAAC;EACjE,cAAc,GAAc,MACxB4C,EAAiBzB,GAAM,EAAE,GAAGN,EAAQ,IAAI,MAAab,EAAS,YAAY,CAAC;EAC/E;EACA,MAAM,GAAc,MAChBkB,EAAY1B,EAAO,SAAS2B,GAAM;GAAE,QAAQ3B,EAAO;GAAQ;EAAO,CAAC;CAC3E;AACJ"}

package/dist/http/build-url.cjs

@@ -1,2 +1,2 @@
-var e=/^[a-z][a-z\d+\-.]*:/i;function t(e){return e.split(`/`).filter(Boolean)}function n(e,t){return t.length===0||t.length>e.length?!1:t.every((t,n)=>e[n]===t)}function r(e){let t=globalThis.location?.origin;if(!t)throw TypeError(`createApiClient: baseURL "${e}" is relative and there is no location to resolve it against. Pass an absolute URL (https://api.example.com) outside the browser.`);return t}function i(t,n,r={}){let{prefix:i,params:o}=r,s=e.test(n)?new URL(n):new URL(a(t,n,i));if(o)for(let[e,t]of Object.entries(o))t!=null&&s.searchParams.set(e,String(t));return s.toString()}function a(i,a,o){let s=e.test(i)?new URL(i):new URL(i,r(i)),c=a.indexOf(`?`),l=c===-1?a:a.slice(0,c),u=c===-1?``:a.slice(c),d=[...t(s.pathname),...t(o??``)],f=t(l),p=n(f,d)?f:[...d,...f],m=l.endsWith(`/`)?`/`:``,h=p.length>0?`/${p.join(`/`)}${m}`:`/`;return`${s.origin}${h}${u}`}exports.buildApiUrl=i;
+var e=/^[a-z][a-z\d+\-.]*:/i;function t(e){return e.split(`/`).filter(Boolean)}function n(e,t){return t.length===0||t.length>e.length?!1:t.every((t,n)=>e[n]===t)}function r(e){let t=globalThis.location?.origin;if(!t)throw TypeError(`createApiClient: baseURL "${e}" is relative and there is no location to resolve it against. Pass an absolute URL (https://api.example.com) outside the browser.`);return t}function i(t,n,r={}){let{prefix:i,params:o}=r;if(e.test(n)&&!Object.values(o??{}).some(e=>e!=null))return n;let s=e.test(n)?new URL(n):new URL(a(t,n,i));if(o)for(let[e,t]of Object.entries(o))t!=null&&s.searchParams.set(e,String(t));return s.toString()}function a(i,a,o){let s=e.test(i)?new URL(i):new URL(i,r(i)),c=a.indexOf(`?`),l=c===-1?a:a.slice(0,c),u=c===-1?``:a.slice(c),d=[...t(s.pathname),...t(o??``)],f=t(l),p=n(f,d)?f:[...d,...f],m=l.endsWith(`/`)?`/`:``,h=p.length>0?`/${p.join(`/`)}${m}`:`/`;return`${s.origin}${h}${u}`}exports.buildApiUrl=i;
 //# sourceMappingURL=build-url.cjs.map

package/dist/http/build-url.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"build-url.cjs","names":[],"sources":["../../src/http/build-url.ts"],"sourcesContent":["/**\n * Matches a path that already carries its own scheme (`https:`, `blob:`), which\n * makes it an absolute URL rather than something to resolve against the base.\n */\nconst ABSOLUTE_URL = /^[a-z][a-z\\d+\\-.]*:/i;\n\n/** Split a path into its non-empty segments, dropping surrounding slashes. */\nfunction segments(path: string): string[] {\n    return path.split(\"/\").filter(Boolean);\n}\n\n/**\n * Whether `path` already starts with every segment of `prefix`.\n *\n * Compared segment by segment, so a `/api` prefix is not considered present in\n * `/api-keys` — a plain `startsWith` would swallow the resource.\n *\n * @param path - Segments of the request path.\n * @param prefix - Segments of the base path.\n * @returns Whether the prefix is already applied.\n */\nfunction startsWithSegments(path: string[], prefix: string[]): boolean {\n    if (prefix.length === 0 || prefix.length > path.length) return false;\n    return prefix.every((segment, index) => path[index] === segment);\n}\n\n/**\n * Resolve the origin a relative `baseURL` hangs off.\n *\n * A base such as `\"/api\"` is the shape you get behind a dev-server proxy or a\n * reverse proxy that serves app and API from one host. It only means something\n * in a browsing context, so this throws with the config to fix rather than\n * letting `new URL` report `Invalid base URL` from three frames deeper.\n *\n * @param baseURL - The base as the caller wrote it.\n * @returns The origin to resolve against.\n * @throws When there is no `location` to borrow an origin from.\n */\nfunction currentOrigin(baseURL: string): string {\n    const origin = globalThis.location?.origin;\n    if (!origin) {\n        throw new TypeError(\n            `createApiClient: baseURL \"${baseURL}\" is relative and there is no location to resolve it against. Pass an absolute URL (https://api.example.com) outside the browser.`,\n        );\n    }\n    return origin;\n}\n\n/** Options accepted by {@link buildApiUrl}. */\nexport interface BuildApiUrlOptions {\n    /**\n     * Path segment every request is nested under, such as `\"/api\"`. Joined\n     * after the path the `baseURL` already carries.\n     */\n    prefix?: string;\n    /** Query params to append. `undefined` and `null` values are skipped. */\n    params?: Record<string, string | number | boolean | undefined | null>;\n}\n\n/**\n * Join a base URL, an optional prefix and a request path into an absolute URL.\n *\n * `new URL(path, base)` on its own is wrong for an API client. It follows the\n * URL spec, where a path starting with `/` is absolute against the *origin* and\n * therefore discards whatever path the base carried: a client on\n * `https://api.example.com/api` asked for `/auth/login` reaches\n * `https://api.example.com/auth/login`, and every request 404s with nothing in\n * the config that looks wrong. This function resolves the path against the base\n * *path* instead, so the leading slash is a matter of taste rather than a\n * silent 404, and `baseURL` + `prefix` are interchangeable ways to say the same\n * thing.\n *\n * The prefix is applied at most once: a path that already opens with it — say\n * `\"/api/auth/login\"` under a `\"/api\"` prefix — is left alone, so a codebase\n * migrating to `prefix` can move its call sites one at a time. The check is per\n * segment, so `/api-keys` is not mistaken for an already-prefixed path.\n *\n * A path that is itself an absolute URL wins over all of this, which is how a\n * client reaches a second host (a signed upload endpoint, a CDN) without a\n * second client.\n *\n * @example\n * buildApiUrl(\"https://api.example.com\", \"/auth/login\", { prefix: \"/api\" });\n * // \"https://api.example.com/api/auth/login\"\n *\n * buildApiUrl(\"https://api.example.com/api\", \"auth/login\");\n * // \"https://api.example.com/api/auth/login\"\n *\n * @param baseURL - Absolute base URL, or a path relative to the current origin.\n * @param path - The request path, or an absolute URL to use as-is.\n * @param options - Optional prefix and query params.\n * @returns The absolute URL to fetch.\n * @throws When `baseURL` is relative and there is no `location` to resolve it.\n */\nexport function buildApiUrl(\n    baseURL: string,\n    path: string,\n    options: BuildApiUrlOptions = {},\n): string {\n    const { prefix, params } = options;\n    const url = ABSOLUTE_URL.test(path) ? new URL(path) : new URL(resolve(baseURL, path, prefix));\n\n    if (params) {\n        for (const [key, value] of Object.entries(params)) {\n            if (value !== undefined && value !== null) {\n                url.searchParams.set(key, String(value));\n            }\n        }\n    }\n    return url.toString();\n}\n\n/**\n * Build the absolute URL string for a path that is not already absolute.\n *\n * Kept separate from {@link buildApiUrl} so the query-param loop is not nested\n * inside the joining rules.\n *\n * @param baseURL - Absolute base URL, or a path relative to the current origin.\n * @param path - The request path.\n * @param prefix - Optional segment every request is nested under.\n * @returns The joined absolute URL.\n */\nfunction resolve(baseURL: string, path: string, prefix?: string): string {\n    const base = ABSOLUTE_URL.test(baseURL)\n        ? new URL(baseURL)\n        : new URL(baseURL, currentOrigin(baseURL));\n\n    const queryStart = path.indexOf(\"?\");\n    const rawPath = queryStart === -1 ? path : path.slice(0, queryStart);\n    const query = queryStart === -1 ? \"\" : path.slice(queryStart);\n\n    const basePath = [...segments(base.pathname), ...segments(prefix ?? \"\")];\n    const requested = segments(rawPath);\n    const joined = startsWithSegments(requested, basePath)\n        ? requested\n        : [...basePath, ...requested];\n\n    const trailing = rawPath.endsWith(\"/\") ? \"/\" : \"\";\n    const pathname = joined.length > 0 ? `/${joined.join(\"/\")}${trailing}` : \"/\";\n    return `${base.origin}${pathname}${query}`;\n}\n"],"mappings":"AAIA,IAAM,EAAe,uBAGrB,SAAS,EAAS,EAAwB,CACtC,OAAO,EAAK,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO,CACzC,CAYA,SAAS,EAAmB,EAAgB,EAA2B,CAEnE,OADI,EAAO,SAAW,GAAK,EAAO,OAAS,EAAK,OAAe,GACxD,EAAO,OAAO,EAAS,IAAU,EAAK,KAAW,CAAO,CACnE,CAcA,SAAS,EAAc,EAAyB,CAC5C,IAAM,EAAS,WAAW,UAAU,OACpC,GAAI,CAAC,EACD,MAAU,UACN,6BAA6B,EAAQ,kIACzC,EAEJ,OAAO,CACX,CAgDA,SAAgB,EACZ,EACA,EACA,EAA8B,CAAC,EACzB,CACN,GAAM,CAAE,SAAQ,UAAW,EACrB,EAAM,EAAa,KAAK,CAAI,EAAI,IAAI,IAAI,CAAI,EAAI,IAAI,IAAI,EAAQ,EAAS,EAAM,CAAM,CAAC,EAE5F,GAAI,EACK,IAAA,GAAM,CAAC,EAAK,KAAU,OAAO,QAAQ,CAAM,EACxC,GAAiC,MACjC,EAAI,aAAa,IAAI,EAAK,OAAO,CAAK,CAAC,EAInD,OAAO,EAAI,SAAS,CACxB,CAaA,SAAS,EAAQ,EAAiB,EAAc,EAAyB,CACrE,IAAM,EAAO,EAAa,KAAK,CAAO,EAChC,IAAI,IAAI,CAAO,EACf,IAAI,IAAI,EAAS,EAAc,CAAO,CAAC,EAEvC,EAAa,EAAK,QAAQ,GAAG,EAC7B,EAAU,IAAe,GAAK,EAAO,EAAK,MAAM,EAAG,CAAU,EAC7D,EAAQ,IAAe,GAAK,GAAK,EAAK,MAAM,CAAU,EAEtD,EAAW,CAAC,GAAG,EAAS,EAAK,QAAQ,EAAG,GAAG,EAAS,GAAU,EAAE,CAAC,EACjE,EAAY,EAAS,CAAO,EAC5B,EAAS,EAAmB,EAAW,CAAQ,EAC/C,EACA,CAAC,GAAG,EAAU,GAAG,CAAS,EAE1B,EAAW,EAAQ,SAAS,GAAG,EAAI,IAAM,GACzC,EAAW,EAAO,OAAS,EAAI,IAAI,EAAO,KAAK,GAAG,IAAI,IAAa,IACzE,MAAO,GAAG,EAAK,SAAS,IAAW,GACvC"}
+{"version":3,"file":"build-url.cjs","names":["ABSOLUTE_URL","segments","path","startsWithSegments","prefix","index","segment","currentOrigin","origin","baseURL","buildApiUrl","options","params","value","url","resolve","key","base","queryStart","rawPath","query","basePath","requested","joined","trailing","pathname"],"sources":["../../src/http/build-url.ts"],"sourcesContent":["/**\n * Matches a path that already carries its own scheme (`https:`, `blob:`), which\n * makes it an absolute URL rather than something to resolve against the base.\n */\nconst ABSOLUTE_URL = /^[a-z][a-z\\d+\\-.]*:/i;\n\n/** Split a path into its non-empty segments, dropping surrounding slashes. */\nfunction segments(path: string): string[] {\n    return path.split(\"/\").filter(Boolean);\n}\n\n/**\n * Whether `path` already starts with every segment of `prefix`.\n *\n * Compared segment by segment, so a `/api` prefix is not considered present in\n * `/api-keys` — a plain `startsWith` would swallow the resource.\n *\n * @param path - Segments of the request path.\n * @param prefix - Segments of the base path.\n * @returns Whether the prefix is already applied.\n */\nfunction startsWithSegments(path: string[], prefix: string[]): boolean {\n    if (prefix.length === 0 || prefix.length > path.length) return false;\n    return prefix.every((segment, index) => path[index] === segment);\n}\n\n/**\n * Resolve the origin a relative `baseURL` hangs off.\n *\n * A base such as `\"/api\"` is the shape you get behind a dev-server proxy or a\n * reverse proxy that serves app and API from one host. It only means something\n * in a browsing context, so this throws with the config to fix rather than\n * letting `new URL` report `Invalid base URL` from three frames deeper.\n *\n * @param baseURL - The base as the caller wrote it.\n * @returns The origin to resolve against.\n * @throws When there is no `location` to borrow an origin from.\n */\nfunction currentOrigin(baseURL: string): string {\n    const origin = globalThis.location?.origin;\n    if (!origin) {\n        throw new TypeError(\n            `createApiClient: baseURL \"${baseURL}\" is relative and there is no location to resolve it against. Pass an absolute URL (https://api.example.com) outside the browser.`,\n        );\n    }\n    return origin;\n}\n\n/** Options accepted by {@link buildApiUrl}. */\nexport interface BuildApiUrlOptions {\n    /**\n     * Path segment every request is nested under, such as `\"/api\"`. Joined\n     * after the path the `baseURL` already carries.\n     */\n    prefix?: string;\n    /** Query params to append. `undefined` and `null` values are skipped. */\n    params?: Record<string, string | number | boolean | undefined | null>;\n}\n\n/**\n * Join a base URL, an optional prefix and a request path into an absolute URL.\n *\n * `new URL(path, base)` on its own is wrong for an API client. It follows the\n * URL spec, where a path starting with `/` is absolute against the *origin* and\n * therefore discards whatever path the base carried: a client on\n * `https://api.example.com/api` asked for `/auth/login` reaches\n * `https://api.example.com/auth/login`, and every request 404s with nothing in\n * the config that looks wrong. This function resolves the path against the base\n * *path* instead, so the leading slash is a matter of taste rather than a\n * silent 404, and `baseURL` + `prefix` are interchangeable ways to say the same\n * thing.\n *\n * The prefix is applied at most once: a path that already opens with it — say\n * `\"/api/auth/login\"` under a `\"/api\"` prefix — is left alone, so a codebase\n * migrating to `prefix` can move its call sites one at a time. The check is per\n * segment, so `/api-keys` is not mistaken for an already-prefixed path.\n *\n * A path that is itself an absolute URL wins over all of this, which is how a\n * client reaches a second host (a signed upload endpoint, a CDN) without a\n * second client. Without `params` it is returned exactly as given: a signed\n * URL covers its query, and a round trip through `URL` re-encodes characters\n * outside the canonical form (`'` became `%27`, measured), which is a rewrite\n * of a string the server signed.\n *\n * @example\n * buildApiUrl(\"https://api.example.com\", \"/auth/login\", { prefix: \"/api\" });\n * // \"https://api.example.com/api/auth/login\"\n *\n * buildApiUrl(\"https://api.example.com/api\", \"auth/login\");\n * // \"https://api.example.com/api/auth/login\"\n *\n * @param baseURL - Absolute base URL, or a path relative to the current origin.\n * @param path - The request path, or an absolute URL to use as-is.\n * @param options - Optional prefix and query params.\n * @returns The absolute URL to fetch.\n * @throws When `baseURL` is relative and there is no `location` to resolve it.\n */\nexport function buildApiUrl(\n    baseURL: string,\n    path: string,\n    options: BuildApiUrlOptions = {},\n): string {\n    const { prefix, params } = options;\n    if (ABSOLUTE_URL.test(path) && !Object.values(params ?? {}).some((value) => value != null)) {\n        return path;\n    }\n    const url = ABSOLUTE_URL.test(path) ? new URL(path) : new URL(resolve(baseURL, path, prefix));\n\n    if (params) {\n        for (const [key, value] of Object.entries(params)) {\n            if (value !== undefined && value !== null) {\n                url.searchParams.set(key, String(value));\n            }\n        }\n    }\n    return url.toString();\n}\n\n/**\n * Build the absolute URL string for a path that is not already absolute.\n *\n * Kept separate from {@link buildApiUrl} so the query-param loop is not nested\n * inside the joining rules.\n *\n * @param baseURL - Absolute base URL, or a path relative to the current origin.\n * @param path - The request path.\n * @param prefix - Optional segment every request is nested under.\n * @returns The joined absolute URL.\n */\nfunction resolve(baseURL: string, path: string, prefix?: string): string {\n    const base = ABSOLUTE_URL.test(baseURL)\n        ? new URL(baseURL)\n        : new URL(baseURL, currentOrigin(baseURL));\n\n    const queryStart = path.indexOf(\"?\");\n    const rawPath = queryStart === -1 ? path : path.slice(0, queryStart);\n    const query = queryStart === -1 ? \"\" : path.slice(queryStart);\n\n    const basePath = [...segments(base.pathname), ...segments(prefix ?? \"\")];\n    const requested = segments(rawPath);\n    const joined = startsWithSegments(requested, basePath)\n        ? requested\n        : [...basePath, ...requested];\n\n    const trailing = rawPath.endsWith(\"/\") ? \"/\" : \"\";\n    const pathname = joined.length > 0 ? `/${joined.join(\"/\")}${trailing}` : \"/\";\n    return `${base.origin}${pathname}${query}`;\n}\n"],"mappings":"AAIA,IAAMA,EAAe,uBAGrB,SAASC,EAAS,EAAwB,CACtC,OAAOC,EAAK,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO,CACzC,CAYA,SAASC,EAAmB,EAAgB,EAA2B,CAEnE,OADIC,EAAO,SAAW,GAAKA,EAAO,OAASF,EAAK,OAAe,GACxDE,EAAO,OAAO,EAAS,IAAUF,EAAKG,KAAWC,CAAO,CACnE,CAcA,SAASC,EAAc,EAAyB,CAC5C,IAAMC,EAAS,WAAW,UAAU,OACpC,GAAI,CAACA,EACD,MAAU,UACN,6BAA6BC,EAAQ,kIACzC,EAEJ,OAAOD,CACX,CAmDA,SAAgBE,EACZ,EACA,EACA,EAA8B,CAAC,EACzB,CACN,GAAM,CAAE,SAAQ,UAAWC,EAC3B,GAAIX,EAAa,KAAKE,CAAI,GAAK,CAAC,OAAO,OAAOU,GAAU,CAAC,CAAC,CAAC,CAAC,KAAM,GAAUC,GAAS,IAAI,EACrF,OAAOX,EAEX,IAAMY,EAAMd,EAAa,KAAKE,CAAI,EAAI,IAAI,IAAIA,CAAI,EAAI,IAAI,IAAIa,EAAQN,EAASP,EAAME,CAAM,CAAC,EAE5F,GAAIQ,EACK,IAAA,GAAM,CAACI,EAAKH,KAAU,OAAO,QAAQD,CAAM,EACxCC,GAAiC,MACjCC,EAAI,aAAa,IAAIE,EAAK,OAAOH,CAAK,CAAC,EAInD,OAAOC,EAAI,SAAS,CACxB,CAaA,SAASC,EAAQ,EAAiB,EAAc,EAAyB,CACrE,IAAME,EAAOjB,EAAa,KAAKS,CAAO,EAChC,IAAI,IAAIA,CAAO,EACf,IAAI,IAAIA,EAASF,EAAcE,CAAO,CAAC,EAEvCS,EAAahB,EAAK,QAAQ,GAAG,EAC7BiB,EAAUD,IAAe,GAAKhB,EAAOA,EAAK,MAAM,EAAGgB,CAAU,EAC7DE,EAAQF,IAAe,GAAK,GAAKhB,EAAK,MAAMgB,CAAU,EAEtDG,EAAW,CAAC,GAAGpB,EAASgB,EAAK,QAAQ,EAAG,GAAGhB,EAASG,GAAU,EAAE,CAAC,EACjEkB,EAAYrB,EAASkB,CAAO,EAC5BI,EAASpB,EAAmBmB,EAAWD,CAAQ,EAC/CC,EACA,CAAC,GAAGD,EAAU,GAAGC,CAAS,EAE1BE,EAAWL,EAAQ,SAAS,GAAG,EAAI,IAAM,GACzCM,EAAWF,EAAO,OAAS,EAAI,IAAIA,EAAO,KAAK,GAAG,IAAIC,IAAa,IACzE,MAAO,GAAGP,EAAK,SAASQ,IAAWL,GACvC,C"}

package/dist/http/build-url.js

@@ -12,7 +12,9 @@ function r(e) {
 	return t;
 }
 function i(t, n, r = {}) {
-	let { prefix: i, params: o } = r, s = e.test(n) ? new URL(n) : new URL(a(t, n, i));
+	let { prefix: i, params: o } = r;
+	if (e.test(n) && !Object.values(o ?? {}).some((e) => e != null)) return n;
+	let s = e.test(n) ? new URL(n) : new URL(a(t, n, i));
 	if (o) for (let [e, t] of Object.entries(o)) t != null && s.searchParams.set(e, String(t));
 	return s.toString();
 }

package/dist/http/build-url.js.map

@@ -1 +1 @@
-{"version":3,"file":"build-url.js","names":[],"sources":["../../src/http/build-url.ts"],"sourcesContent":["/**\n * Matches a path that already carries its own scheme (`https:`, `blob:`), which\n * makes it an absolute URL rather than something to resolve against the base.\n */\nconst ABSOLUTE_URL = /^[a-z][a-z\\d+\\-.]*:/i;\n\n/** Split a path into its non-empty segments, dropping surrounding slashes. */\nfunction segments(path: string): string[] {\n    return path.split(\"/\").filter(Boolean);\n}\n\n/**\n * Whether `path` already starts with every segment of `prefix`.\n *\n * Compared segment by segment, so a `/api` prefix is not considered present in\n * `/api-keys` — a plain `startsWith` would swallow the resource.\n *\n * @param path - Segments of the request path.\n * @param prefix - Segments of the base path.\n * @returns Whether the prefix is already applied.\n */\nfunction startsWithSegments(path: string[], prefix: string[]): boolean {\n    if (prefix.length === 0 || prefix.length > path.length) return false;\n    return prefix.every((segment, index) => path[index] === segment);\n}\n\n/**\n * Resolve the origin a relative `baseURL` hangs off.\n *\n * A base such as `\"/api\"` is the shape you get behind a dev-server proxy or a\n * reverse proxy that serves app and API from one host. It only means something\n * in a browsing context, so this throws with the config to fix rather than\n * letting `new URL` report `Invalid base URL` from three frames deeper.\n *\n * @param baseURL - The base as the caller wrote it.\n * @returns The origin to resolve against.\n * @throws When there is no `location` to borrow an origin from.\n */\nfunction currentOrigin(baseURL: string): string {\n    const origin = globalThis.location?.origin;\n    if (!origin) {\n        throw new TypeError(\n            `createApiClient: baseURL \"${baseURL}\" is relative and there is no location to resolve it against. Pass an absolute URL (https://api.example.com) outside the browser.`,\n        );\n    }\n    return origin;\n}\n\n/** Options accepted by {@link buildApiUrl}. */\nexport interface BuildApiUrlOptions {\n    /**\n     * Path segment every request is nested under, such as `\"/api\"`. Joined\n     * after the path the `baseURL` already carries.\n     */\n    prefix?: string;\n    /** Query params to append. `undefined` and `null` values are skipped. */\n    params?: Record<string, string | number | boolean | undefined | null>;\n}\n\n/**\n * Join a base URL, an optional prefix and a request path into an absolute URL.\n *\n * `new URL(path, base)` on its own is wrong for an API client. It follows the\n * URL spec, where a path starting with `/` is absolute against the *origin* and\n * therefore discards whatever path the base carried: a client on\n * `https://api.example.com/api` asked for `/auth/login` reaches\n * `https://api.example.com/auth/login`, and every request 404s with nothing in\n * the config that looks wrong. This function resolves the path against the base\n * *path* instead, so the leading slash is a matter of taste rather than a\n * silent 404, and `baseURL` + `prefix` are interchangeable ways to say the same\n * thing.\n *\n * The prefix is applied at most once: a path that already opens with it — say\n * `\"/api/auth/login\"` under a `\"/api\"` prefix — is left alone, so a codebase\n * migrating to `prefix` can move its call sites one at a time. The check is per\n * segment, so `/api-keys` is not mistaken for an already-prefixed path.\n *\n * A path that is itself an absolute URL wins over all of this, which is how a\n * client reaches a second host (a signed upload endpoint, a CDN) without a\n * second client.\n *\n * @example\n * buildApiUrl(\"https://api.example.com\", \"/auth/login\", { prefix: \"/api\" });\n * // \"https://api.example.com/api/auth/login\"\n *\n * buildApiUrl(\"https://api.example.com/api\", \"auth/login\");\n * // \"https://api.example.com/api/auth/login\"\n *\n * @param baseURL - Absolute base URL, or a path relative to the current origin.\n * @param path - The request path, or an absolute URL to use as-is.\n * @param options - Optional prefix and query params.\n * @returns The absolute URL to fetch.\n * @throws When `baseURL` is relative and there is no `location` to resolve it.\n */\nexport function buildApiUrl(\n    baseURL: string,\n    path: string,\n    options: BuildApiUrlOptions = {},\n): string {\n    const { prefix, params } = options;\n    const url = ABSOLUTE_URL.test(path) ? new URL(path) : new URL(resolve(baseURL, path, prefix));\n\n    if (params) {\n        for (const [key, value] of Object.entries(params)) {\n            if (value !== undefined && value !== null) {\n                url.searchParams.set(key, String(value));\n            }\n        }\n    }\n    return url.toString();\n}\n\n/**\n * Build the absolute URL string for a path that is not already absolute.\n *\n * Kept separate from {@link buildApiUrl} so the query-param loop is not nested\n * inside the joining rules.\n *\n * @param baseURL - Absolute base URL, or a path relative to the current origin.\n * @param path - The request path.\n * @param prefix - Optional segment every request is nested under.\n * @returns The joined absolute URL.\n */\nfunction resolve(baseURL: string, path: string, prefix?: string): string {\n    const base = ABSOLUTE_URL.test(baseURL)\n        ? new URL(baseURL)\n        : new URL(baseURL, currentOrigin(baseURL));\n\n    const queryStart = path.indexOf(\"?\");\n    const rawPath = queryStart === -1 ? path : path.slice(0, queryStart);\n    const query = queryStart === -1 ? \"\" : path.slice(queryStart);\n\n    const basePath = [...segments(base.pathname), ...segments(prefix ?? \"\")];\n    const requested = segments(rawPath);\n    const joined = startsWithSegments(requested, basePath)\n        ? requested\n        : [...basePath, ...requested];\n\n    const trailing = rawPath.endsWith(\"/\") ? \"/\" : \"\";\n    const pathname = joined.length > 0 ? `/${joined.join(\"/\")}${trailing}` : \"/\";\n    return `${base.origin}${pathname}${query}`;\n}\n"],"mappings":";AAIA,IAAM,IAAe;AAGrB,SAAS,EAAS,GAAwB;CACtC,OAAO,EAAK,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO;AACzC;AAYA,SAAS,EAAmB,GAAgB,GAA2B;CAEnE,OADI,EAAO,WAAW,KAAK,EAAO,SAAS,EAAK,SAAe,KACxD,EAAO,OAAO,GAAS,MAAU,EAAK,OAAW,CAAO;AACnE;AAcA,SAAS,EAAc,GAAyB;CAC5C,IAAM,IAAS,WAAW,UAAU;CACpC,IAAI,CAAC,GACD,MAAU,UACN,6BAA6B,EAAQ,kIACzC;CAEJ,OAAO;AACX;AAgDA,SAAgB,EACZ,GACA,GACA,IAA8B,CAAC,GACzB;CACN,IAAM,EAAE,WAAQ,cAAW,GACrB,IAAM,EAAa,KAAK,CAAI,IAAI,IAAI,IAAI,CAAI,IAAI,IAAI,IAAI,EAAQ,GAAS,GAAM,CAAM,CAAC;CAE5F,IAAI,GACK,KAAA,IAAM,CAAC,GAAK,MAAU,OAAO,QAAQ,CAAM,GAC5C,AAAI,KAAiC,QACjC,EAAI,aAAa,IAAI,GAAK,OAAO,CAAK,CAAC;CAInD,OAAO,EAAI,SAAS;AACxB;AAaA,SAAS,EAAQ,GAAiB,GAAc,GAAyB;CACrE,IAAM,IAAO,EAAa,KAAK,CAAO,IAChC,IAAI,IAAI,CAAO,IACf,IAAI,IAAI,GAAS,EAAc,CAAO,CAAC,GAEvC,IAAa,EAAK,QAAQ,GAAG,GAC7B,IAAU,MAAe,KAAK,IAAO,EAAK,MAAM,GAAG,CAAU,GAC7D,IAAQ,MAAe,KAAK,KAAK,EAAK,MAAM,CAAU,GAEtD,IAAW,CAAC,GAAG,EAAS,EAAK,QAAQ,GAAG,GAAG,EAAS,KAAU,EAAE,CAAC,GACjE,IAAY,EAAS,CAAO,GAC5B,IAAS,EAAmB,GAAW,CAAQ,IAC/C,IACA,CAAC,GAAG,GAAU,GAAG,CAAS,GAE1B,IAAW,EAAQ,SAAS,GAAG,IAAI,MAAM,IACzC,IAAW,EAAO,SAAS,IAAI,IAAI,EAAO,KAAK,GAAG,IAAI,MAAa;CACzE,OAAO,GAAG,EAAK,SAAS,IAAW;AACvC"}
+{"version":3,"file":"build-url.js","names":["ABSOLUTE_URL","segments","path","startsWithSegments","prefix","index","segment","currentOrigin","origin","baseURL","buildApiUrl","options","params","value","url","resolve","key","base","queryStart","rawPath","query","basePath","requested","joined","trailing","pathname"],"sources":["../../src/http/build-url.ts"],"sourcesContent":["/**\n * Matches a path that already carries its own scheme (`https:`, `blob:`), which\n * makes it an absolute URL rather than something to resolve against the base.\n */\nconst ABSOLUTE_URL = /^[a-z][a-z\\d+\\-.]*:/i;\n\n/** Split a path into its non-empty segments, dropping surrounding slashes. */\nfunction segments(path: string): string[] {\n    return path.split(\"/\").filter(Boolean);\n}\n\n/**\n * Whether `path` already starts with every segment of `prefix`.\n *\n * Compared segment by segment, so a `/api` prefix is not considered present in\n * `/api-keys` — a plain `startsWith` would swallow the resource.\n *\n * @param path - Segments of the request path.\n * @param prefix - Segments of the base path.\n * @returns Whether the prefix is already applied.\n */\nfunction startsWithSegments(path: string[], prefix: string[]): boolean {\n    if (prefix.length === 0 || prefix.length > path.length) return false;\n    return prefix.every((segment, index) => path[index] === segment);\n}\n\n/**\n * Resolve the origin a relative `baseURL` hangs off.\n *\n * A base such as `\"/api\"` is the shape you get behind a dev-server proxy or a\n * reverse proxy that serves app and API from one host. It only means something\n * in a browsing context, so this throws with the config to fix rather than\n * letting `new URL` report `Invalid base URL` from three frames deeper.\n *\n * @param baseURL - The base as the caller wrote it.\n * @returns The origin to resolve against.\n * @throws When there is no `location` to borrow an origin from.\n */\nfunction currentOrigin(baseURL: string): string {\n    const origin = globalThis.location?.origin;\n    if (!origin) {\n        throw new TypeError(\n            `createApiClient: baseURL \"${baseURL}\" is relative and there is no location to resolve it against. Pass an absolute URL (https://api.example.com) outside the browser.`,\n        );\n    }\n    return origin;\n}\n\n/** Options accepted by {@link buildApiUrl}. */\nexport interface BuildApiUrlOptions {\n    /**\n     * Path segment every request is nested under, such as `\"/api\"`. Joined\n     * after the path the `baseURL` already carries.\n     */\n    prefix?: string;\n    /** Query params to append. `undefined` and `null` values are skipped. */\n    params?: Record<string, string | number | boolean | undefined | null>;\n}\n\n/**\n * Join a base URL, an optional prefix and a request path into an absolute URL.\n *\n * `new URL(path, base)` on its own is wrong for an API client. It follows the\n * URL spec, where a path starting with `/` is absolute against the *origin* and\n * therefore discards whatever path the base carried: a client on\n * `https://api.example.com/api` asked for `/auth/login` reaches\n * `https://api.example.com/auth/login`, and every request 404s with nothing in\n * the config that looks wrong. This function resolves the path against the base\n * *path* instead, so the leading slash is a matter of taste rather than a\n * silent 404, and `baseURL` + `prefix` are interchangeable ways to say the same\n * thing.\n *\n * The prefix is applied at most once: a path that already opens with it — say\n * `\"/api/auth/login\"` under a `\"/api\"` prefix — is left alone, so a codebase\n * migrating to `prefix` can move its call sites one at a time. The check is per\n * segment, so `/api-keys` is not mistaken for an already-prefixed path.\n *\n * A path that is itself an absolute URL wins over all of this, which is how a\n * client reaches a second host (a signed upload endpoint, a CDN) without a\n * second client. Without `params` it is returned exactly as given: a signed\n * URL covers its query, and a round trip through `URL` re-encodes characters\n * outside the canonical form (`'` became `%27`, measured), which is a rewrite\n * of a string the server signed.\n *\n * @example\n * buildApiUrl(\"https://api.example.com\", \"/auth/login\", { prefix: \"/api\" });\n * // \"https://api.example.com/api/auth/login\"\n *\n * buildApiUrl(\"https://api.example.com/api\", \"auth/login\");\n * // \"https://api.example.com/api/auth/login\"\n *\n * @param baseURL - Absolute base URL, or a path relative to the current origin.\n * @param path - The request path, or an absolute URL to use as-is.\n * @param options - Optional prefix and query params.\n * @returns The absolute URL to fetch.\n * @throws When `baseURL` is relative and there is no `location` to resolve it.\n */\nexport function buildApiUrl(\n    baseURL: string,\n    path: string,\n    options: BuildApiUrlOptions = {},\n): string {\n    const { prefix, params } = options;\n    if (ABSOLUTE_URL.test(path) && !Object.values(params ?? {}).some((value) => value != null)) {\n        return path;\n    }\n    const url = ABSOLUTE_URL.test(path) ? new URL(path) : new URL(resolve(baseURL, path, prefix));\n\n    if (params) {\n        for (const [key, value] of Object.entries(params)) {\n            if (value !== undefined && value !== null) {\n                url.searchParams.set(key, String(value));\n            }\n        }\n    }\n    return url.toString();\n}\n\n/**\n * Build the absolute URL string for a path that is not already absolute.\n *\n * Kept separate from {@link buildApiUrl} so the query-param loop is not nested\n * inside the joining rules.\n *\n * @param baseURL - Absolute base URL, or a path relative to the current origin.\n * @param path - The request path.\n * @param prefix - Optional segment every request is nested under.\n * @returns The joined absolute URL.\n */\nfunction resolve(baseURL: string, path: string, prefix?: string): string {\n    const base = ABSOLUTE_URL.test(baseURL)\n        ? new URL(baseURL)\n        : new URL(baseURL, currentOrigin(baseURL));\n\n    const queryStart = path.indexOf(\"?\");\n    const rawPath = queryStart === -1 ? path : path.slice(0, queryStart);\n    const query = queryStart === -1 ? \"\" : path.slice(queryStart);\n\n    const basePath = [...segments(base.pathname), ...segments(prefix ?? \"\")];\n    const requested = segments(rawPath);\n    const joined = startsWithSegments(requested, basePath)\n        ? requested\n        : [...basePath, ...requested];\n\n    const trailing = rawPath.endsWith(\"/\") ? \"/\" : \"\";\n    const pathname = joined.length > 0 ? `/${joined.join(\"/\")}${trailing}` : \"/\";\n    return `${base.origin}${pathname}${query}`;\n}\n"],"mappings":";AAIA,IAAMA,IAAe;AAGrB,SAASC,EAAS,GAAwB;CACtC,OAAOC,EAAK,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO;AACzC;AAYA,SAASC,EAAmB,GAAgB,GAA2B;CAEnE,OADIC,EAAO,WAAW,KAAKA,EAAO,SAASF,EAAK,SAAe,KACxDE,EAAO,OAAO,GAAS,MAAUF,EAAKG,OAAWC,CAAO;AACnE;AAcA,SAASC,EAAc,GAAyB;CAC5C,IAAMC,IAAS,WAAW,UAAU;CACpC,IAAI,CAACA,GACD,MAAU,UACN,6BAA6BC,EAAQ,kIACzC;CAEJ,OAAOD;AACX;AAmDA,SAAgBE,EACZ,GACA,GACA,IAA8B,CAAC,GACzB;CACN,IAAM,EAAE,WAAQ,cAAWC;CAC3B,IAAIX,EAAa,KAAKE,CAAI,KAAK,CAAC,OAAO,OAAOU,KAAU,CAAC,CAAC,CAAC,CAAC,MAAM,MAAUC,KAAS,IAAI,GACrF,OAAOX;CAEX,IAAMY,IAAMd,EAAa,KAAKE,CAAI,IAAI,IAAI,IAAIA,CAAI,IAAI,IAAI,IAAIa,EAAQN,GAASP,GAAME,CAAM,CAAC;CAE5F,IAAIQ,GACK,KAAA,IAAM,CAACI,GAAKH,MAAU,OAAO,QAAQD,CAAM,GAC5C,AAAIC,KAAiC,QACjCC,EAAI,aAAa,IAAIE,GAAK,OAAOH,CAAK,CAAC;CAInD,OAAOC,EAAI,SAAS;AACxB;AAaA,SAASC,EAAQ,GAAiB,GAAc,GAAyB;CACrE,IAAME,IAAOjB,EAAa,KAAKS,CAAO,IAChC,IAAI,IAAIA,CAAO,IACf,IAAI,IAAIA,GAASF,EAAcE,CAAO,CAAC,GAEvCS,IAAahB,EAAK,QAAQ,GAAG,GAC7BiB,IAAUD,MAAe,KAAKhB,IAAOA,EAAK,MAAM,GAAGgB,CAAU,GAC7DE,IAAQF,MAAe,KAAK,KAAKhB,EAAK,MAAMgB,CAAU,GAEtDG,IAAW,CAAC,GAAGpB,EAASgB,EAAK,QAAQ,GAAG,GAAGhB,EAASG,KAAU,EAAE,CAAC,GACjEkB,IAAYrB,EAASkB,CAAO,GAC5BI,IAASpB,EAAmBmB,GAAWD,CAAQ,IAC/CC,IACA,CAAC,GAAGD,GAAU,GAAGC,CAAS,GAE1BE,IAAWL,EAAQ,SAAS,GAAG,IAAI,MAAM,IACzCM,IAAWF,EAAO,SAAS,IAAI,IAAIA,EAAO,KAAK,GAAG,IAAIC,MAAa;CACzE,OAAO,GAAGP,EAAK,SAASQ,IAAWL;AACvC"}

package/dist/http/credential-scope.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"credential-scope.cjs","names":[],"sources":["../../src/http/credential-scope.ts"],"sourcesContent":["import { isDevBuild } from \"../utils/dev-mode\";\n\n/**\n * Origins already reported by {@link reportSuppressedCredential}, so a chunked\n * upload warns once instead of once per chunk.\n */\nconst reported = new Set<string>();\n\n/**\n * The origin a URL resolves to, or `null` when it has none to compare.\n *\n * Relative values resolve against the document, because that is what they mean\n * everywhere else in the SDK: an `endpoint` of `\"/api/uploads\"` and a `baseURL`\n * of `\"/api\"` are the shape you get behind a dev-server or a reverse proxy, and\n * both name the page's own origin. Comparing a resolved absolute target against\n * an unresolved relative reference is how the first draft of this function\n * withheld the credential from every client configured that way.\n *\n * `null` is reserved for the case with genuinely nothing to compare: a relative\n * URL outside a browsing context, where there is no document to resolve against.\n *\n * @param url - Absolute or relative URL.\n * @returns The origin, or `null` when it cannot be resolved.\n */\nfunction originOf(url: string): string | null {\n    try {\n        return new URL(url, globalThis.location?.href).origin;\n    } catch {\n        return null;\n    }\n}\n\n/**\n * Whether a request to `target` may carry the caller's credential.\n *\n * The SDK writes `Authorization: Bearer` in three places, and until 0.66.0 none\n * of them looked at where the request was going. That is only safe while every\n * target URL is written by the app: a resumable upload takes its URL from the\n * server's `Location` header, and `createApiClient` lets an absolute path\n * override `baseURL` entirely, so a URL arriving over the network could decide\n * which origin received the token — and the file bytes with it.\n *\n * Handing an upload off to object storage on another host is ordinary `tus`\n * deployment, not an attack, which is exactly why the credential must be scoped\n * rather than the request blocked: the upload still goes through, it just goes\n * without the API's bearer token.\n *\n * Both sides are resolved against the document first, so a relative `baseURL`\n * or `endpoint` — the shape behind a dev-server or reverse proxy — compares\n * equal to the absolute URL the request actually goes to. Outside a browsing\n * context a relative target resolves to nothing and is allowed: there is no\n * origin for it to cross.\n *\n * @param target - The URL the request is about to go to.\n * @param reference - The origin the credential belongs to, normally the\n *     client's `baseURL` or the upload `endpoint`.\n * @param trustedOrigins - Extra origins the app declared, for the legitimate\n *     second host: a CDN, a signed upload endpoint.\n * @returns Whether the credential may be attached.\n *\n * @example\n * isTrustedCredentialTarget(\"https://api.acme.com/me\", \"https://api.acme.com\");\n * // true\n * isTrustedCredentialTarget(\"https://cdn.other/u/1\", \"https://api.acme.com\");\n * // false\n */\nexport function isTrustedCredentialTarget(\n    target: string,\n    reference: string,\n    trustedOrigins: readonly string[] = [],\n): boolean {\n    const targetOrigin = originOf(target);\n    if (targetOrigin === null) return true;\n    if (targetOrigin === originOf(reference)) return true;\n    return trustedOrigins.some((origin) => originOf(origin) === targetOrigin);\n}\n\n/**\n * Say once, in a development build, that a credential was withheld.\n *\n * Without it the symptom is a `401` (or, for the CSRF header, a `403`) from a\n * host the developer never typed, and nothing in the app's code mentions the\n * origin that produced it. Keyed by credential and target origin, so a\n * hundred-chunk upload reports one line per header it withheld.\n *\n * Silent in production for the same reason {@link parseResponse} is: the origin\n * an app talks to is not something to print into a user's console or ship to an\n * error tracker.\n *\n * @param target - The URL whose request went out unauthenticated.\n * @param reference - The origin the credential was scoped to.\n * @param header - The header that was withheld. Default `\"Authorization\"`.\n */\nexport function reportSuppressedCredential(\n    target: string,\n    reference: string,\n    header = \"Authorization\",\n): void {\n    if (!isDevBuild()) return;\n    const targetOrigin = originOf(target);\n    if (targetOrigin === null) return;\n    const key = `${header} ${targetOrigin}`;\n    if (reported.has(key)) return;\n    reported.add(key);\n    console.warn(\n        `[tempest-react-sdk] ${header} was not sent to ${targetOrigin}: the credential is scoped to ${originOf(reference) ?? reference}. Add the origin to trustedOrigins if it should receive the token.`,\n    );\n}\n\n/**\n * Forget which origins were already reported.\n *\n * Exported for tests, which assert the once-per-origin behaviour and would\n * otherwise leak state between cases.\n */\nexport function resetSuppressedCredentialReports(): void {\n    reported.clear();\n}\n"],"mappings":"yCAMA,IAAM,EAAW,IAAI,IAkBrB,SAAS,EAAS,EAA4B,CAC1C,GAAI,CACA,OAAO,IAAI,IAAI,EAAK,WAAW,UAAU,IAAI,CAAC,CAAC,MACnD,MAAQ,CACJ,OAAO,IACX,CACJ,CAoCA,SAAgB,EACZ,EACA,EACA,EAAoC,CAAC,EAC9B,CACP,IAAM,EAAe,EAAS,CAAM,EAGpC,OAFI,IAAiB,MACjB,IAAiB,EAAS,CAAS,GAChC,EAAe,KAAM,GAAW,EAAS,CAAM,IAAM,CAAY,CAC5E,CAkBA,SAAgB,EACZ,EACA,EACA,EAAS,gBACL,CACJ,GAAI,CAAC,EAAA,WAAW,EAAG,OACnB,IAAM,EAAe,EAAS,CAAM,EACpC,GAAI,IAAiB,KAAM,OAC3B,IAAM,EAAM,GAAG,EAAO,GAAG,IACrB,EAAS,IAAI,CAAG,IACpB,EAAS,IAAI,CAAG,EAChB,QAAQ,KACJ,uBAAuB,EAAO,mBAAmB,EAAa,gCAAgC,EAAS,CAAS,GAAK,EAAU,mEACnI,EACJ"}
+{"version":3,"file":"credential-scope.cjs","names":["isDevBuild","require_dev_mode","reported","originOf","url","isTrustedCredentialTarget","targetOrigin","target","reference","trustedOrigins","origin","reportSuppressedCredential","key","header"],"sources":["../../src/http/credential-scope.ts"],"sourcesContent":["import { isDevBuild } from \"../utils/dev-mode\";\n\n/**\n * Origins already reported by {@link reportSuppressedCredential}, so a chunked\n * upload warns once instead of once per chunk.\n */\nconst reported = new Set<string>();\n\n/**\n * The origin a URL resolves to, or `null` when it has none to compare.\n *\n * Relative values resolve against the document, because that is what they mean\n * everywhere else in the SDK: an `endpoint` of `\"/api/uploads\"` and a `baseURL`\n * of `\"/api\"` are the shape you get behind a dev-server or a reverse proxy, and\n * both name the page's own origin. Comparing a resolved absolute target against\n * an unresolved relative reference is how the first draft of this function\n * withheld the credential from every client configured that way.\n *\n * `null` is reserved for the case with genuinely nothing to compare: a relative\n * URL outside a browsing context, where there is no document to resolve against.\n *\n * @param url - Absolute or relative URL.\n * @returns The origin, or `null` when it cannot be resolved.\n */\nfunction originOf(url: string): string | null {\n    try {\n        return new URL(url, globalThis.location?.href).origin;\n    } catch {\n        return null;\n    }\n}\n\n/**\n * Whether a request to `target` may carry the caller's credential.\n *\n * The SDK writes `Authorization: Bearer` in three places, and until 0.66.0 none\n * of them looked at where the request was going. That is only safe while every\n * target URL is written by the app: a resumable upload takes its URL from the\n * server's `Location` header, and `createApiClient` lets an absolute path\n * override `baseURL` entirely, so a URL arriving over the network could decide\n * which origin received the token — and the file bytes with it.\n *\n * Handing an upload off to object storage on another host is ordinary `tus`\n * deployment, not an attack, which is exactly why the credential must be scoped\n * rather than the request blocked: the upload still goes through, it just goes\n * without the API's bearer token.\n *\n * Both sides are resolved against the document first, so a relative `baseURL`\n * or `endpoint` — the shape behind a dev-server or reverse proxy — compares\n * equal to the absolute URL the request actually goes to. Outside a browsing\n * context a relative target resolves to nothing and is allowed: there is no\n * origin for it to cross.\n *\n * @param target - The URL the request is about to go to.\n * @param reference - The origin the credential belongs to, normally the\n *     client's `baseURL` or the upload `endpoint`.\n * @param trustedOrigins - Extra origins the app declared, for the legitimate\n *     second host: a CDN, a signed upload endpoint.\n * @returns Whether the credential may be attached.\n *\n * @example\n * isTrustedCredentialTarget(\"https://api.acme.com/me\", \"https://api.acme.com\");\n * // true\n * isTrustedCredentialTarget(\"https://cdn.other/u/1\", \"https://api.acme.com\");\n * // false\n */\nexport function isTrustedCredentialTarget(\n    target: string,\n    reference: string,\n    trustedOrigins: readonly string[] = [],\n): boolean {\n    const targetOrigin = originOf(target);\n    if (targetOrigin === null) return true;\n    if (targetOrigin === originOf(reference)) return true;\n    return trustedOrigins.some((origin) => originOf(origin) === targetOrigin);\n}\n\n/**\n * Say once, in a development build, that a credential was withheld.\n *\n * Without it the symptom is a `401` (or, for the CSRF header, a `403`) from a\n * host the developer never typed, and nothing in the app's code mentions the\n * origin that produced it. Keyed by credential and target origin, so a\n * hundred-chunk upload reports one line per header it withheld.\n *\n * Silent in production for the same reason {@link parseResponse} is: the origin\n * an app talks to is not something to print into a user's console or ship to an\n * error tracker.\n *\n * @param target - The URL whose request went out unauthenticated.\n * @param reference - The origin the credential was scoped to.\n * @param header - The header that was withheld. Default `\"Authorization\"`.\n */\nexport function reportSuppressedCredential(\n    target: string,\n    reference: string,\n    header = \"Authorization\",\n): void {\n    if (!isDevBuild()) return;\n    const targetOrigin = originOf(target);\n    if (targetOrigin === null) return;\n    const key = `${header} ${targetOrigin}`;\n    if (reported.has(key)) return;\n    reported.add(key);\n    console.warn(\n        `[tempest-react-sdk] ${header} was not sent to ${targetOrigin}: the credential is scoped to ${originOf(reference) ?? reference}. Add the origin to trustedOrigins if it should receive the token.`,\n    );\n}\n\n/**\n * Forget which origins were already reported.\n *\n * Exported for tests, which assert the once-per-origin behaviour and would\n * otherwise leak state between cases.\n */\nexport function resetSuppressedCredentialReports(): void {\n    reported.clear();\n}\n"],"mappings":"A,yCAMA,IAAME,EAAW,IAAI,IAkBrB,SAASC,EAAS,EAA4B,CAC1C,GAAI,CACA,OAAO,IAAI,IAAIC,EAAK,WAAW,UAAU,IAAI,CAAC,CAAC,MACnD,MAAQ,CACJ,OAAO,IACX,CACJ,CAoCA,SAAgBC,EACZ,EACA,EACA,EAAoC,CAAC,EAC9B,CACP,IAAMC,EAAeH,EAASI,CAAM,EAGpC,OAFID,IAAiB,MACjBA,IAAiBH,EAASK,CAAS,GAChCC,EAAe,KAAM,GAAWN,EAASO,CAAM,IAAMJ,CAAY,CAC5E,CAkBA,SAAgBK,EACZ,EACA,EACA,EAAS,gBACL,CACJ,GAAI,CAACX,EAAAA,WAAW,EAAG,OACnB,IAAMM,EAAeH,EAASI,CAAM,EACpC,GAAID,IAAiB,KAAM,OAC3B,IAAMM,EAAM,GAAGC,EAAO,GAAGP,IACrBJ,EAAS,IAAIU,CAAG,IACpBV,EAAS,IAAIU,CAAG,EAChB,QAAQ,KACJ,uBAAuBC,EAAO,mBAAmBP,EAAa,gCAAgCH,EAASK,CAAS,GAAKA,EAAU,mEACnI,EACJ,C"}

package/dist/http/credential-scope.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-scope.js","names":[],"sources":["../../src/http/credential-scope.ts"],"sourcesContent":["import { isDevBuild } from \"../utils/dev-mode\";\n\n/**\n * Origins already reported by {@link reportSuppressedCredential}, so a chunked\n * upload warns once instead of once per chunk.\n */\nconst reported = new Set<string>();\n\n/**\n * The origin a URL resolves to, or `null` when it has none to compare.\n *\n * Relative values resolve against the document, because that is what they mean\n * everywhere else in the SDK: an `endpoint` of `\"/api/uploads\"` and a `baseURL`\n * of `\"/api\"` are the shape you get behind a dev-server or a reverse proxy, and\n * both name the page's own origin. Comparing a resolved absolute target against\n * an unresolved relative reference is how the first draft of this function\n * withheld the credential from every client configured that way.\n *\n * `null` is reserved for the case with genuinely nothing to compare: a relative\n * URL outside a browsing context, where there is no document to resolve against.\n *\n * @param url - Absolute or relative URL.\n * @returns The origin, or `null` when it cannot be resolved.\n */\nfunction originOf(url: string): string | null {\n    try {\n        return new URL(url, globalThis.location?.href).origin;\n    } catch {\n        return null;\n    }\n}\n\n/**\n * Whether a request to `target` may carry the caller's credential.\n *\n * The SDK writes `Authorization: Bearer` in three places, and until 0.66.0 none\n * of them looked at where the request was going. That is only safe while every\n * target URL is written by the app: a resumable upload takes its URL from the\n * server's `Location` header, and `createApiClient` lets an absolute path\n * override `baseURL` entirely, so a URL arriving over the network could decide\n * which origin received the token — and the file bytes with it.\n *\n * Handing an upload off to object storage on another host is ordinary `tus`\n * deployment, not an attack, which is exactly why the credential must be scoped\n * rather than the request blocked: the upload still goes through, it just goes\n * without the API's bearer token.\n *\n * Both sides are resolved against the document first, so a relative `baseURL`\n * or `endpoint` — the shape behind a dev-server or reverse proxy — compares\n * equal to the absolute URL the request actually goes to. Outside a browsing\n * context a relative target resolves to nothing and is allowed: there is no\n * origin for it to cross.\n *\n * @param target - The URL the request is about to go to.\n * @param reference - The origin the credential belongs to, normally the\n *     client's `baseURL` or the upload `endpoint`.\n * @param trustedOrigins - Extra origins the app declared, for the legitimate\n *     second host: a CDN, a signed upload endpoint.\n * @returns Whether the credential may be attached.\n *\n * @example\n * isTrustedCredentialTarget(\"https://api.acme.com/me\", \"https://api.acme.com\");\n * // true\n * isTrustedCredentialTarget(\"https://cdn.other/u/1\", \"https://api.acme.com\");\n * // false\n */\nexport function isTrustedCredentialTarget(\n    target: string,\n    reference: string,\n    trustedOrigins: readonly string[] = [],\n): boolean {\n    const targetOrigin = originOf(target);\n    if (targetOrigin === null) return true;\n    if (targetOrigin === originOf(reference)) return true;\n    return trustedOrigins.some((origin) => originOf(origin) === targetOrigin);\n}\n\n/**\n * Say once, in a development build, that a credential was withheld.\n *\n * Without it the symptom is a `401` (or, for the CSRF header, a `403`) from a\n * host the developer never typed, and nothing in the app's code mentions the\n * origin that produced it. Keyed by credential and target origin, so a\n * hundred-chunk upload reports one line per header it withheld.\n *\n * Silent in production for the same reason {@link parseResponse} is: the origin\n * an app talks to is not something to print into a user's console or ship to an\n * error tracker.\n *\n * @param target - The URL whose request went out unauthenticated.\n * @param reference - The origin the credential was scoped to.\n * @param header - The header that was withheld. Default `\"Authorization\"`.\n */\nexport function reportSuppressedCredential(\n    target: string,\n    reference: string,\n    header = \"Authorization\",\n): void {\n    if (!isDevBuild()) return;\n    const targetOrigin = originOf(target);\n    if (targetOrigin === null) return;\n    const key = `${header} ${targetOrigin}`;\n    if (reported.has(key)) return;\n    reported.add(key);\n    console.warn(\n        `[tempest-react-sdk] ${header} was not sent to ${targetOrigin}: the credential is scoped to ${originOf(reference) ?? reference}. Add the origin to trustedOrigins if it should receive the token.`,\n    );\n}\n\n/**\n * Forget which origins were already reported.\n *\n * Exported for tests, which assert the once-per-origin behaviour and would\n * otherwise leak state between cases.\n */\nexport function resetSuppressedCredentialReports(): void {\n    reported.clear();\n}\n"],"mappings":";;AAMA,IAAM,oBAAW,IAAI,IAAY;AAkBjC,SAAS,EAAS,GAA4B;CAC1C,IAAI;EACA,OAAO,IAAI,IAAI,GAAK,WAAW,UAAU,IAAI,CAAC,CAAC;CACnD,QAAQ;EACJ,OAAO;CACX;AACJ;AAoCA,SAAgB,EACZ,GACA,GACA,IAAoC,CAAC,GAC9B;CACP,IAAM,IAAe,EAAS,CAAM;CAGpC,OAFI,MAAiB,QACjB,MAAiB,EAAS,CAAS,KAChC,EAAe,MAAM,MAAW,EAAS,CAAM,MAAM,CAAY;AAC5E;AAkBA,SAAgB,EACZ,GACA,GACA,IAAS,iBACL;CACJ,IAAI,CAAC,EAAW,GAAG;CACnB,IAAM,IAAe,EAAS,CAAM;CACpC,IAAI,MAAiB,MAAM;CAC3B,IAAM,IAAM,GAAG,EAAO,GAAG;CACrB,EAAS,IAAI,CAAG,MACpB,EAAS,IAAI,CAAG,GAChB,QAAQ,KACJ,uBAAuB,EAAO,mBAAmB,EAAa,gCAAgC,EAAS,CAAS,KAAK,EAAU,mEACnI;AACJ"}
+{"version":3,"file":"credential-scope.js","names":["reported","originOf","url","isTrustedCredentialTarget","targetOrigin","target","reference","trustedOrigins","origin","reportSuppressedCredential","isDevBuild","key","header"],"sources":["../../src/http/credential-scope.ts"],"sourcesContent":["import { isDevBuild } from \"../utils/dev-mode\";\n\n/**\n * Origins already reported by {@link reportSuppressedCredential}, so a chunked\n * upload warns once instead of once per chunk.\n */\nconst reported = new Set<string>();\n\n/**\n * The origin a URL resolves to, or `null` when it has none to compare.\n *\n * Relative values resolve against the document, because that is what they mean\n * everywhere else in the SDK: an `endpoint` of `\"/api/uploads\"` and a `baseURL`\n * of `\"/api\"` are the shape you get behind a dev-server or a reverse proxy, and\n * both name the page's own origin. Comparing a resolved absolute target against\n * an unresolved relative reference is how the first draft of this function\n * withheld the credential from every client configured that way.\n *\n * `null` is reserved for the case with genuinely nothing to compare: a relative\n * URL outside a browsing context, where there is no document to resolve against.\n *\n * @param url - Absolute or relative URL.\n * @returns The origin, or `null` when it cannot be resolved.\n */\nfunction originOf(url: string): string | null {\n    try {\n        return new URL(url, globalThis.location?.href).origin;\n    } catch {\n        return null;\n    }\n}\n\n/**\n * Whether a request to `target` may carry the caller's credential.\n *\n * The SDK writes `Authorization: Bearer` in three places, and until 0.66.0 none\n * of them looked at where the request was going. That is only safe while every\n * target URL is written by the app: a resumable upload takes its URL from the\n * server's `Location` header, and `createApiClient` lets an absolute path\n * override `baseURL` entirely, so a URL arriving over the network could decide\n * which origin received the token — and the file bytes with it.\n *\n * Handing an upload off to object storage on another host is ordinary `tus`\n * deployment, not an attack, which is exactly why the credential must be scoped\n * rather than the request blocked: the upload still goes through, it just goes\n * without the API's bearer token.\n *\n * Both sides are resolved against the document first, so a relative `baseURL`\n * or `endpoint` — the shape behind a dev-server or reverse proxy — compares\n * equal to the absolute URL the request actually goes to. Outside a browsing\n * context a relative target resolves to nothing and is allowed: there is no\n * origin for it to cross.\n *\n * @param target - The URL the request is about to go to.\n * @param reference - The origin the credential belongs to, normally the\n *     client's `baseURL` or the upload `endpoint`.\n * @param trustedOrigins - Extra origins the app declared, for the legitimate\n *     second host: a CDN, a signed upload endpoint.\n * @returns Whether the credential may be attached.\n *\n * @example\n * isTrustedCredentialTarget(\"https://api.acme.com/me\", \"https://api.acme.com\");\n * // true\n * isTrustedCredentialTarget(\"https://cdn.other/u/1\", \"https://api.acme.com\");\n * // false\n */\nexport function isTrustedCredentialTarget(\n    target: string,\n    reference: string,\n    trustedOrigins: readonly string[] = [],\n): boolean {\n    const targetOrigin = originOf(target);\n    if (targetOrigin === null) return true;\n    if (targetOrigin === originOf(reference)) return true;\n    return trustedOrigins.some((origin) => originOf(origin) === targetOrigin);\n}\n\n/**\n * Say once, in a development build, that a credential was withheld.\n *\n * Without it the symptom is a `401` (or, for the CSRF header, a `403`) from a\n * host the developer never typed, and nothing in the app's code mentions the\n * origin that produced it. Keyed by credential and target origin, so a\n * hundred-chunk upload reports one line per header it withheld.\n *\n * Silent in production for the same reason {@link parseResponse} is: the origin\n * an app talks to is not something to print into a user's console or ship to an\n * error tracker.\n *\n * @param target - The URL whose request went out unauthenticated.\n * @param reference - The origin the credential was scoped to.\n * @param header - The header that was withheld. Default `\"Authorization\"`.\n */\nexport function reportSuppressedCredential(\n    target: string,\n    reference: string,\n    header = \"Authorization\",\n): void {\n    if (!isDevBuild()) return;\n    const targetOrigin = originOf(target);\n    if (targetOrigin === null) return;\n    const key = `${header} ${targetOrigin}`;\n    if (reported.has(key)) return;\n    reported.add(key);\n    console.warn(\n        `[tempest-react-sdk] ${header} was not sent to ${targetOrigin}: the credential is scoped to ${originOf(reference) ?? reference}. Add the origin to trustedOrigins if it should receive the token.`,\n    );\n}\n\n/**\n * Forget which origins were already reported.\n *\n * Exported for tests, which assert the once-per-origin behaviour and would\n * otherwise leak state between cases.\n */\nexport function resetSuppressedCredentialReports(): void {\n    reported.clear();\n}\n"],"mappings":";;AAMA,IAAMA,oBAAW,IAAI,IAAY;AAkBjC,SAASC,EAAS,GAA4B;CAC1C,IAAI;EACA,OAAO,IAAI,IAAIC,GAAK,WAAW,UAAU,IAAI,CAAC,CAAC;CACnD,QAAQ;EACJ,OAAO;CACX;AACJ;AAoCA,SAAgBC,EACZ,GACA,GACA,IAAoC,CAAC,GAC9B;CACP,IAAMC,IAAeH,EAASI,CAAM;CAGpC,OAFID,MAAiB,QACjBA,MAAiBH,EAASK,CAAS,KAChCC,EAAe,MAAM,MAAWN,EAASO,CAAM,MAAMJ,CAAY;AAC5E;AAkBA,SAAgBK,EACZ,GACA,GACA,IAAS,iBACL;CACJ,IAAI,CAACC,EAAW,GAAG;CACnB,IAAMN,IAAeH,EAASI,CAAM;CACpC,IAAID,MAAiB,MAAM;CAC3B,IAAMO,IAAM,GAAGC,EAAO,GAAGR;CACzB,AAAIJ,EAAS,IAAIW,CAAG,MACpBX,EAAS,IAAIW,CAAG,GAChB,QAAQ,KACJ,uBAAuBC,EAAO,mBAAmBR,EAAa,gCAAgCH,EAASK,CAAS,KAAKA,EAAU,mEACnI;AACJ"}

package/dist/http/csrf.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"csrf.cjs","names":[],"sources":["../../src/http/csrf.ts"],"sourcesContent":["import { isDevBuild } from \"../utils/dev-mode\";\nimport { isTrustedCredentialTarget, reportSuppressedCredential } from \"./credential-scope\";\n\n/**\n * Default cookie the CSRF token is read from.\n *\n * Ported from `tempest-fastapi-sdk`'s `CSRF_COOKIE_NAME`\n * (`tempest_fastapi_sdk/api/middlewares/csrf.py`), which is the cookie its\n * `make_csrf_token_dependency()` sets and its `CSRFMiddleware` compares against.\n * Matching it is what lets `csrf: true` work against that backend with no\n * configuration on either side.\n */\nexport const DEFAULT_CSRF_COOKIE_NAME = \"csrf_token\";\n\n/**\n * Default header the CSRF token is echoed in.\n *\n * Ported from `tempest-fastapi-sdk`'s `CSRF_HEADER_NAME`, the header its\n * `CSRFMiddleware` reads on every unsafe request.\n */\nexport const DEFAULT_CSRF_HEADER_NAME = \"X-CSRF-Token\";\n\n/**\n * Where the CSRF token comes from and which header carries it.\n *\n * The default is the **double-submit cookie**: the server sets a cookie that is\n * deliberately not `HttpOnly`, the client reads it and echoes the value in a\n * header, and the server rejects a write whose header does not match the\n * cookie. A page on another site can make the browser *send* the cookie, but\n * cannot *read* it, so it cannot write the header.\n *\n * The token is read again on every request, so a server that rotates the\n * cookie is followed without any capture step: the browser's cookie jar is the\n * store. That is also why there is no \"read the token from a response header\"\n * mode — it would depend on `Access-Control-Expose-Headers`, and a missing\n * expose header fails silently, as a `403` on the second write.\n */\nexport interface CsrfOptions {\n    /** Cookie to read the token from. Default {@link DEFAULT_CSRF_COOKIE_NAME}. */\n    cookieName?: string;\n    /** Header to send the token in. Default {@link DEFAULT_CSRF_HEADER_NAME}. */\n    headerName?: string;\n    /**\n     * Supply the token yourself instead of reading `cookieName`.\n     *\n     * For the cases the cookie cannot serve: an API on another **site**, whose\n     * cookie `document.cookie` cannot see, or a backend that hands the token\n     * out in a response body. Called per request, like `getToken`.\n     */\n    getToken?: () => string | null | undefined;\n}\n\n/**\n * Methods that must not change state, and so never carry the token.\n *\n * A deny list rather than an allow list of the four write verbs: RFC 9110\n * names the safe methods, and a custom method (`PROPFIND`, a tus extension)\n * is a write until proven otherwise. Sending the token to its own origin on\n * an unexpected verb costs nothing; omitting it costs a `403`.\n */\nconst SAFE_METHODS: ReadonlySet<string> = new Set([\"GET\", \"HEAD\", \"OPTIONS\", \"TRACE\"]);\n\n/** Token sources already reported empty, so a burst of writes warns once. */\nconst reportedMissing = new Set<string>();\n\n/**\n * Read one cookie from `document.cookie`, or `null` when it is absent.\n *\n * Returns `null` outside a document (a worker, a test without jsdom), where\n * there is no cookie jar to read. The value is URI-decoded when it can be,\n * and returned raw when it is not valid percent-encoding.\n *\n * @param name - The cookie name.\n * @returns The value, or `null`.\n */\nfunction readCookie(name: string): string | null {\n    if (typeof document === \"undefined\") return null;\n    const prefix = `${name}=`;\n    for (const part of document.cookie.split(\";\")) {\n        const entry = part.trim();\n        if (!entry.startsWith(prefix)) continue;\n        const raw = entry.slice(prefix.length);\n        try {\n            return decodeURIComponent(raw);\n        } catch {\n            return raw;\n        }\n    }\n    return null;\n}\n\n/**\n * Say once, in a development build, that CSRF is on but there is no token.\n *\n * The request still goes out, because the SDK cannot know whether this path\n * is guarded — `CSRFMiddleware` is commonly mounted with `exclude_paths`. When\n * it is guarded, the symptom is a `403 CSRF_VALIDATION_FAILED` with nothing\n * in the app's code pointing at the cause, and the three usual causes are all\n * on the server: the cookie was never issued, was issued `HttpOnly`, or was\n * issued for a domain this page cannot read.\n *\n * @param source - What was read: the cookie name, or `\"getToken\"`.\n */\nfunction reportMissingToken(source: string): void {\n    if (!isDevBuild() || reportedMissing.has(source)) return;\n    reportedMissing.add(source);\n    const where =\n        source === \"getToken\"\n            ? \"csrf.getToken() returned nothing\"\n            : `no readable \"${source}\" cookie on this page`;\n    console.warn(\n        `[tempest-react-sdk] CSRF is enabled but ${where}, so the write went without the token. The cookie must be issued before the first write and must not be HttpOnly.`,\n    );\n}\n\n/**\n * Whether a header is already present, compared case-insensitively.\n *\n * Header names are case-insensitive, but object keys are not: a caller's\n * `\"x-csrf-token\"` next to the SDK's `\"X-CSRF-Token\"` would reach `fetch` as\n * two entries and be joined into `\"a, b\"`, which matches neither.\n *\n * @param headers - The headers the caller already set.\n * @param name - The header to look for.\n * @returns Whether it is set.\n */\nfunction hasHeader(headers: HeadersInit | undefined, name: string): boolean {\n    if (!headers) return false;\n    return new Headers(headers).has(name);\n}\n\n/** What {@link csrfHeaders} needs to decide. */\nexport interface CsrfHeadersInput {\n    /** The HTTP method of the request. Case-insensitive. */\n    method: string;\n    /** The URL the request is going to. */\n    url: string;\n    /**\n     * The origin the token belongs to, normally the API's `baseURL`. The token\n     * is only sent to this origin or to one listed in `trustedOrigins`.\n     */\n    reference: string;\n    /** The CSRF config. `undefined` or `false` turns the header off. */\n    csrf: boolean | CsrfOptions | undefined;\n    /** Extra origins allowed to receive the token. */\n    trustedOrigins?: readonly string[];\n    /** Headers the caller already set. A CSRF header among them is never replaced. */\n    headers?: HeadersInit;\n}\n\n/**\n * The CSRF header a request should carry, or an empty object.\n *\n * Every request path in the SDK — `createApiClient`, `uploadWithProgress`,\n * `createResumableUpload` — asks this function, so the rules are one rule:\n *\n * - **Off unless configured.** Without `csrf`, nothing changes.\n * - **Unsafe methods only.** `GET`, `HEAD`, `OPTIONS` and `TRACE` never carry\n *   it; they must not change state, and a token in a `GET` ends up in logs\n *   and caches for nothing.\n * - **Never across an origin.** The token follows the same scope as the bearer\n *   credential ({@link isTrustedCredentialTarget}), because a URL can come off\n *   the network — a tus `Location`, a pagination link — and a CSRF token sent\n *   to a third party is a token that third party can replay. Withheld tokens\n *   are reported once per origin in a development build.\n * - **Your header wins.** A CSRF header you set by hand, in any casing, is\n *   left alone.\n * - **Independent of auth.** It is sent on `skipAuth` requests too: login and\n *   refresh are exactly the writes a cookie session exposes to forgery.\n *\n * Exported for the request you build by hand, so it follows the same rules.\n *\n * @example\n * const headers = csrfHeaders({\n *     method: \"POST\",\n *     url: \"https://api.acme.com/orders\",\n *     reference: \"https://api.acme.com\",\n *     csrf: true,\n * });\n * // { \"X-CSRF-Token\": \"<value of the csrf_token cookie>\" }\n *\n * @param input - The request and the CSRF config.\n * @returns A header record to spread into the request's headers.\n */\nexport function csrfHeaders(input: CsrfHeadersInput): Record<string, string> {\n    const { method, url, reference, csrf, trustedOrigins, headers } = input;\n    if (!csrf) return {};\n    if (SAFE_METHODS.has(method.toUpperCase())) return {};\n    const options: CsrfOptions = csrf === true ? {} : csrf;\n    const headerName = options.headerName ?? DEFAULT_CSRF_HEADER_NAME;\n    if (hasHeader(headers, headerName)) return {};\n    if (!isTrustedCredentialTarget(url, reference, trustedOrigins)) {\n        reportSuppressedCredential(url, reference, headerName);\n        return {};\n    }\n    const cookieName = options.cookieName ?? DEFAULT_CSRF_COOKIE_NAME;\n    const token = options.getToken ? options.getToken() : readCookie(cookieName);\n    if (!token) {\n        reportMissingToken(options.getToken ? \"getToken\" : cookieName);\n        return {};\n    }\n    return { [headerName]: token };\n}\n\n/**\n * Forget which token sources were already reported empty.\n *\n * Exported for tests, which assert the once-per-source behaviour and would\n * otherwise leak state between cases.\n */\nexport function resetCsrfReports(): void {\n    reportedMissing.clear();\n}\n"],"mappings":"6EAYA,IAAa,EAA2B,aAQ3B,EAA2B,eAwClC,EAAoC,IAAI,IAAI,CAAC,MAAO,OAAQ,UAAW,OAAO,CAAC,EAG/E,EAAkB,IAAI,IAY5B,SAAS,EAAW,EAA6B,CAC7C,GAAI,OAAO,SAAa,IAAa,OAAO,KAC5C,IAAM,EAAS,GAAG,EAAK,GACvB,IAAK,IAAM,KAAQ,SAAS,OAAO,MAAM,GAAG,EAAG,CAC3C,IAAM,EAAQ,EAAK,KAAK,EACxB,GAAI,CAAC,EAAM,WAAW,CAAM,EAAG,SAC/B,IAAM,EAAM,EAAM,MAAM,EAAO,MAAM,EACrC,GAAI,CACA,OAAO,mBAAmB,CAAG,CACjC,MAAQ,CACJ,OAAO,CACX,CACJ,CACA,OAAO,IACX,CAcA,SAAS,EAAmB,EAAsB,CAC9C,GAAI,CAAC,EAAA,WAAW,GAAK,EAAgB,IAAI,CAAM,EAAG,OAClD,EAAgB,IAAI,CAAM,EAC1B,IAAM,EACF,IAAW,WACL,mCACA,gBAAgB,EAAO,uBACjC,QAAQ,KACJ,2CAA2C,EAAM,kHACrD,CACJ,CAaA,SAAS,EAAU,EAAkC,EAAuB,CAExE,OADK,EACE,IAAI,QAAQ,CAAO,CAAC,CAAC,IAAI,CAAI,EADf,EAEzB,CAuDA,SAAgB,EAAY,EAAiD,CACzE,GAAM,CAAE,SAAQ,MAAK,YAAW,OAAM,iBAAgB,WAAY,EAElE,GADI,CAAC,GACD,EAAa,IAAI,EAAO,YAAY,CAAC,EAAG,MAAO,CAAC,EACpD,IAAM,EAAuB,IAAS,GAAO,CAAC,EAAI,EAC5C,EAAa,EAAQ,YAAA,eAC3B,GAAI,EAAU,EAAS,CAAU,EAAG,MAAO,CAAC,EAC5C,GAAI,CAAC,EAAA,0BAA0B,EAAK,EAAW,CAAc,EAEzD,OADA,EAAA,2BAA2B,EAAK,EAAW,CAAU,EAC9C,CAAC,EAEZ,IAAM,EAAa,EAAQ,YAAA,aACrB,EAAQ,EAAQ,SAAW,EAAQ,SAAS,EAAI,EAAW,CAAU,EAK3E,OAJK,EAIE,EAAG,GAAa,CAAM,GAHzB,EAAmB,EAAQ,SAAW,WAAa,CAAU,EACtD,CAAC,EAGhB"}
+{"version":3,"file":"csrf.cjs","names":["isDevBuild","isTrustedCredentialTarget","require_dev_mode","require_credential_scope","DEFAULT_CSRF_COOKIE_NAME","DEFAULT_CSRF_HEADER_NAME","SAFE_METHODS","reportedMissing","readCookie","prefix","name","part","entry","raw","reportMissingToken","source","where","hasHeader","headers","csrfHeaders","input","csrf","method","options","headerName","url","reference","trustedOrigins","cookieName","token"],"sources":["../../src/http/csrf.ts"],"sourcesContent":["import { isDevBuild } from \"../utils/dev-mode\";\nimport { isTrustedCredentialTarget, reportSuppressedCredential } from \"./credential-scope\";\n\n/**\n * Default cookie the CSRF token is read from.\n *\n * Ported from `tempest-fastapi-sdk`'s `CSRF_COOKIE_NAME`\n * (`tempest_fastapi_sdk/api/middlewares/csrf.py`), which is the cookie its\n * `make_csrf_token_dependency()` sets and its `CSRFMiddleware` compares against.\n * Matching it is what lets `csrf: true` work against that backend with no\n * configuration on either side.\n */\nexport const DEFAULT_CSRF_COOKIE_NAME = \"csrf_token\";\n\n/**\n * Default header the CSRF token is echoed in.\n *\n * Ported from `tempest-fastapi-sdk`'s `CSRF_HEADER_NAME`, the header its\n * `CSRFMiddleware` reads on every unsafe request.\n */\nexport const DEFAULT_CSRF_HEADER_NAME = \"X-CSRF-Token\";\n\n/**\n * Where the CSRF token comes from and which header carries it.\n *\n * The default is the **double-submit cookie**: the server sets a cookie that is\n * deliberately not `HttpOnly`, the client reads it and echoes the value in a\n * header, and the server rejects a write whose header does not match the\n * cookie. A page on another site can make the browser *send* the cookie, but\n * cannot *read* it, so it cannot write the header.\n *\n * The token is read again on every request, so a server that rotates the\n * cookie is followed without any capture step: the browser's cookie jar is the\n * store. That is also why there is no \"read the token from a response header\"\n * mode — it would depend on `Access-Control-Expose-Headers`, and a missing\n * expose header fails silently, as a `403` on the second write.\n */\nexport interface CsrfOptions {\n    /** Cookie to read the token from. Default {@link DEFAULT_CSRF_COOKIE_NAME}. */\n    cookieName?: string;\n    /** Header to send the token in. Default {@link DEFAULT_CSRF_HEADER_NAME}. */\n    headerName?: string;\n    /**\n     * Supply the token yourself instead of reading `cookieName`.\n     *\n     * For the cases the cookie cannot serve: an API on another **site**, whose\n     * cookie `document.cookie` cannot see, or a backend that hands the token\n     * out in a response body. Called per request, like `getToken`.\n     */\n    getToken?: () => string | null | undefined;\n}\n\n/**\n * Methods that must not change state, and so never carry the token.\n *\n * A deny list rather than an allow list of the four write verbs: RFC 9110\n * names the safe methods, and a custom method (`PROPFIND`, a tus extension)\n * is a write until proven otherwise. Sending the token to its own origin on\n * an unexpected verb costs nothing; omitting it costs a `403`.\n */\nconst SAFE_METHODS: ReadonlySet<string> = new Set([\"GET\", \"HEAD\", \"OPTIONS\", \"TRACE\"]);\n\n/** Token sources already reported empty, so a burst of writes warns once. */\nconst reportedMissing = new Set<string>();\n\n/**\n * Read one cookie from `document.cookie`, or `null` when it is absent.\n *\n * Returns `null` outside a document (a worker, a test without jsdom), where\n * there is no cookie jar to read. The value is URI-decoded when it can be,\n * and returned raw when it is not valid percent-encoding.\n *\n * @param name - The cookie name.\n * @returns The value, or `null`.\n */\nfunction readCookie(name: string): string | null {\n    if (typeof document === \"undefined\") return null;\n    const prefix = `${name}=`;\n    for (const part of document.cookie.split(\";\")) {\n        const entry = part.trim();\n        if (!entry.startsWith(prefix)) continue;\n        const raw = entry.slice(prefix.length);\n        try {\n            return decodeURIComponent(raw);\n        } catch {\n            return raw;\n        }\n    }\n    return null;\n}\n\n/**\n * Say once, in a development build, that CSRF is on but there is no token.\n *\n * The request still goes out, because the SDK cannot know whether this path\n * is guarded — `CSRFMiddleware` is commonly mounted with `exclude_paths`. When\n * it is guarded, the symptom is a `403 CSRF_VALIDATION_FAILED` with nothing\n * in the app's code pointing at the cause, and the three usual causes are all\n * on the server: the cookie was never issued, was issued `HttpOnly`, or was\n * issued for a domain this page cannot read.\n *\n * @param source - What was read: the cookie name, or `\"getToken\"`.\n */\nfunction reportMissingToken(source: string): void {\n    if (!isDevBuild() || reportedMissing.has(source)) return;\n    reportedMissing.add(source);\n    const where =\n        source === \"getToken\"\n            ? \"csrf.getToken() returned nothing\"\n            : `no readable \"${source}\" cookie on this page`;\n    console.warn(\n        `[tempest-react-sdk] CSRF is enabled but ${where}, so the write went without the token. The cookie must be issued before the first write and must not be HttpOnly.`,\n    );\n}\n\n/**\n * Whether a header is already present, compared case-insensitively.\n *\n * Header names are case-insensitive, but object keys are not: a caller's\n * `\"x-csrf-token\"` next to the SDK's `\"X-CSRF-Token\"` would reach `fetch` as\n * two entries and be joined into `\"a, b\"`, which matches neither.\n *\n * @param headers - The headers the caller already set.\n * @param name - The header to look for.\n * @returns Whether it is set.\n */\nfunction hasHeader(headers: HeadersInit | undefined, name: string): boolean {\n    if (!headers) return false;\n    return new Headers(headers).has(name);\n}\n\n/** What {@link csrfHeaders} needs to decide. */\nexport interface CsrfHeadersInput {\n    /** The HTTP method of the request. Case-insensitive. */\n    method: string;\n    /** The URL the request is going to. */\n    url: string;\n    /**\n     * The origin the token belongs to, normally the API's `baseURL`. The token\n     * is only sent to this origin or to one listed in `trustedOrigins`.\n     */\n    reference: string;\n    /** The CSRF config. `undefined` or `false` turns the header off. */\n    csrf: boolean | CsrfOptions | undefined;\n    /** Extra origins allowed to receive the token. */\n    trustedOrigins?: readonly string[];\n    /** Headers the caller already set. A CSRF header among them is never replaced. */\n    headers?: HeadersInit;\n}\n\n/**\n * The CSRF header a request should carry, or an empty object.\n *\n * Every request path in the SDK — `createApiClient`, `uploadWithProgress`,\n * `createResumableUpload` — asks this function, so the rules are one rule:\n *\n * - **Off unless configured.** Without `csrf`, nothing changes.\n * - **Unsafe methods only.** `GET`, `HEAD`, `OPTIONS` and `TRACE` never carry\n *   it; they must not change state, and a token in a `GET` ends up in logs\n *   and caches for nothing.\n * - **Never across an origin.** The token follows the same scope as the bearer\n *   credential ({@link isTrustedCredentialTarget}), because a URL can come off\n *   the network — a tus `Location`, a pagination link — and a CSRF token sent\n *   to a third party is a token that third party can replay. Withheld tokens\n *   are reported once per origin in a development build.\n * - **Your header wins.** A CSRF header you set by hand, in any casing, is\n *   left alone.\n * - **Independent of auth.** It is sent on `skipAuth` requests too: login and\n *   refresh are exactly the writes a cookie session exposes to forgery.\n *\n * Exported for the request you build by hand, so it follows the same rules.\n *\n * @example\n * const headers = csrfHeaders({\n *     method: \"POST\",\n *     url: \"https://api.acme.com/orders\",\n *     reference: \"https://api.acme.com\",\n *     csrf: true,\n * });\n * // { \"X-CSRF-Token\": \"<value of the csrf_token cookie>\" }\n *\n * @param input - The request and the CSRF config.\n * @returns A header record to spread into the request's headers.\n */\nexport function csrfHeaders(input: CsrfHeadersInput): Record<string, string> {\n    const { method, url, reference, csrf, trustedOrigins, headers } = input;\n    if (!csrf) return {};\n    if (SAFE_METHODS.has(method.toUpperCase())) return {};\n    const options: CsrfOptions = csrf === true ? {} : csrf;\n    const headerName = options.headerName ?? DEFAULT_CSRF_HEADER_NAME;\n    if (hasHeader(headers, headerName)) return {};\n    if (!isTrustedCredentialTarget(url, reference, trustedOrigins)) {\n        reportSuppressedCredential(url, reference, headerName);\n        return {};\n    }\n    const cookieName = options.cookieName ?? DEFAULT_CSRF_COOKIE_NAME;\n    const token = options.getToken ? options.getToken() : readCookie(cookieName);\n    if (!token) {\n        reportMissingToken(options.getToken ? \"getToken\" : cookieName);\n        return {};\n    }\n    return { [headerName]: token };\n}\n\n/**\n * Forget which token sources were already reported empty.\n *\n * Exported for tests, which assert the once-per-source behaviour and would\n * otherwise leak state between cases.\n */\nexport function resetCsrfReports(): void {\n    reportedMissing.clear();\n}\n"],"mappings":"A,6EAYA,IAAaI,EAA2B,aAQ3BC,EAA2B,eAwClCC,EAAoC,IAAI,IAAI,CAAC,MAAO,OAAQ,UAAW,OAAO,CAAC,EAG/EC,EAAkB,IAAI,IAY5B,SAASC,EAAW,EAA6B,CAC7C,GAAI,OAAO,SAAa,IAAa,OAAO,KAC5C,IAAMC,EAAS,GAAGC,EAAK,GACvB,IAAK,IAAMC,KAAQ,SAAS,OAAO,MAAM,GAAG,EAAG,CAC3C,IAAMC,EAAQD,EAAK,KAAK,EACxB,GAAI,CAACC,EAAM,WAAWH,CAAM,EAAG,SAC/B,IAAMI,EAAMD,EAAM,MAAMH,EAAO,MAAM,EACrC,GAAI,CACA,OAAO,mBAAmBI,CAAG,CACjC,MAAQ,CACJ,OAAOA,CACX,CACJ,CACA,OAAO,IACX,CAcA,SAASC,EAAmB,EAAsB,CAC9C,GAAI,CAACd,EAAAA,WAAW,GAAKO,EAAgB,IAAIQ,CAAM,EAAG,OAClDR,EAAgB,IAAIQ,CAAM,EAC1B,IAAMC,EACFD,IAAW,WACL,mCACA,gBAAgBA,EAAO,uBACjC,QAAQ,KACJ,2CAA2CC,EAAM,kHACrD,CACJ,CAaA,SAASC,EAAU,EAAkC,EAAuB,CAExE,OADKC,EACE,IAAI,QAAQA,CAAO,CAAC,CAAC,IAAIR,CAAI,EADf,EAEzB,CAuDA,SAAgBS,EAAY,EAAiD,CACzE,GAAM,CAAE,SAAQ,MAAK,YAAW,OAAM,iBAAgB,WAAYC,EAElE,GADI,CAACC,GACDf,EAAa,IAAIgB,EAAO,YAAY,CAAC,EAAG,MAAO,CAAC,EACpD,IAAMC,EAAuBF,IAAS,GAAO,CAAC,EAAIA,EAC5CG,EAAaD,EAAQ,YAAA,eAC3B,GAAIN,EAAUC,EAASM,CAAU,EAAG,MAAO,CAAC,EAC5C,GAAI,CAACvB,EAAAA,0BAA0BwB,EAAKC,EAAWC,CAAc,EAEzD,OADAxB,EAAA,2BAA2BsB,EAAKC,EAAWF,CAAU,EAC9C,CAAC,EAEZ,IAAMI,EAAaL,EAAQ,YAAA,aACrBM,EAAQN,EAAQ,SAAWA,EAAQ,SAAS,EAAIf,EAAWoB,CAAU,EAK3E,OAJKC,EAIE,EAAGL,GAAaK,CAAM,GAHzBf,EAAmBS,EAAQ,SAAW,WAAaK,CAAU,EACtD,CAAC,EAGhB,C"}

package/dist/http/csrf.js.map

@@ -1 +1 @@
-{"version":3,"file":"csrf.js","names":[],"sources":["../../src/http/csrf.ts"],"sourcesContent":["import { isDevBuild } from \"../utils/dev-mode\";\nimport { isTrustedCredentialTarget, reportSuppressedCredential } from \"./credential-scope\";\n\n/**\n * Default cookie the CSRF token is read from.\n *\n * Ported from `tempest-fastapi-sdk`'s `CSRF_COOKIE_NAME`\n * (`tempest_fastapi_sdk/api/middlewares/csrf.py`), which is the cookie its\n * `make_csrf_token_dependency()` sets and its `CSRFMiddleware` compares against.\n * Matching it is what lets `csrf: true` work against that backend with no\n * configuration on either side.\n */\nexport const DEFAULT_CSRF_COOKIE_NAME = \"csrf_token\";\n\n/**\n * Default header the CSRF token is echoed in.\n *\n * Ported from `tempest-fastapi-sdk`'s `CSRF_HEADER_NAME`, the header its\n * `CSRFMiddleware` reads on every unsafe request.\n */\nexport const DEFAULT_CSRF_HEADER_NAME = \"X-CSRF-Token\";\n\n/**\n * Where the CSRF token comes from and which header carries it.\n *\n * The default is the **double-submit cookie**: the server sets a cookie that is\n * deliberately not `HttpOnly`, the client reads it and echoes the value in a\n * header, and the server rejects a write whose header does not match the\n * cookie. A page on another site can make the browser *send* the cookie, but\n * cannot *read* it, so it cannot write the header.\n *\n * The token is read again on every request, so a server that rotates the\n * cookie is followed without any capture step: the browser's cookie jar is the\n * store. That is also why there is no \"read the token from a response header\"\n * mode — it would depend on `Access-Control-Expose-Headers`, and a missing\n * expose header fails silently, as a `403` on the second write.\n */\nexport interface CsrfOptions {\n    /** Cookie to read the token from. Default {@link DEFAULT_CSRF_COOKIE_NAME}. */\n    cookieName?: string;\n    /** Header to send the token in. Default {@link DEFAULT_CSRF_HEADER_NAME}. */\n    headerName?: string;\n    /**\n     * Supply the token yourself instead of reading `cookieName`.\n     *\n     * For the cases the cookie cannot serve: an API on another **site**, whose\n     * cookie `document.cookie` cannot see, or a backend that hands the token\n     * out in a response body. Called per request, like `getToken`.\n     */\n    getToken?: () => string | null | undefined;\n}\n\n/**\n * Methods that must not change state, and so never carry the token.\n *\n * A deny list rather than an allow list of the four write verbs: RFC 9110\n * names the safe methods, and a custom method (`PROPFIND`, a tus extension)\n * is a write until proven otherwise. Sending the token to its own origin on\n * an unexpected verb costs nothing; omitting it costs a `403`.\n */\nconst SAFE_METHODS: ReadonlySet<string> = new Set([\"GET\", \"HEAD\", \"OPTIONS\", \"TRACE\"]);\n\n/** Token sources already reported empty, so a burst of writes warns once. */\nconst reportedMissing = new Set<string>();\n\n/**\n * Read one cookie from `document.cookie`, or `null` when it is absent.\n *\n * Returns `null` outside a document (a worker, a test without jsdom), where\n * there is no cookie jar to read. The value is URI-decoded when it can be,\n * and returned raw when it is not valid percent-encoding.\n *\n * @param name - The cookie name.\n * @returns The value, or `null`.\n */\nfunction readCookie(name: string): string | null {\n    if (typeof document === \"undefined\") return null;\n    const prefix = `${name}=`;\n    for (const part of document.cookie.split(\";\")) {\n        const entry = part.trim();\n        if (!entry.startsWith(prefix)) continue;\n        const raw = entry.slice(prefix.length);\n        try {\n            return decodeURIComponent(raw);\n        } catch {\n            return raw;\n        }\n    }\n    return null;\n}\n\n/**\n * Say once, in a development build, that CSRF is on but there is no token.\n *\n * The request still goes out, because the SDK cannot know whether this path\n * is guarded — `CSRFMiddleware` is commonly mounted with `exclude_paths`. When\n * it is guarded, the symptom is a `403 CSRF_VALIDATION_FAILED` with nothing\n * in the app's code pointing at the cause, and the three usual causes are all\n * on the server: the cookie was never issued, was issued `HttpOnly`, or was\n * issued for a domain this page cannot read.\n *\n * @param source - What was read: the cookie name, or `\"getToken\"`.\n */\nfunction reportMissingToken(source: string): void {\n    if (!isDevBuild() || reportedMissing.has(source)) return;\n    reportedMissing.add(source);\n    const where =\n        source === \"getToken\"\n            ? \"csrf.getToken() returned nothing\"\n            : `no readable \"${source}\" cookie on this page`;\n    console.warn(\n        `[tempest-react-sdk] CSRF is enabled but ${where}, so the write went without the token. The cookie must be issued before the first write and must not be HttpOnly.`,\n    );\n}\n\n/**\n * Whether a header is already present, compared case-insensitively.\n *\n * Header names are case-insensitive, but object keys are not: a caller's\n * `\"x-csrf-token\"` next to the SDK's `\"X-CSRF-Token\"` would reach `fetch` as\n * two entries and be joined into `\"a, b\"`, which matches neither.\n *\n * @param headers - The headers the caller already set.\n * @param name - The header to look for.\n * @returns Whether it is set.\n */\nfunction hasHeader(headers: HeadersInit | undefined, name: string): boolean {\n    if (!headers) return false;\n    return new Headers(headers).has(name);\n}\n\n/** What {@link csrfHeaders} needs to decide. */\nexport interface CsrfHeadersInput {\n    /** The HTTP method of the request. Case-insensitive. */\n    method: string;\n    /** The URL the request is going to. */\n    url: string;\n    /**\n     * The origin the token belongs to, normally the API's `baseURL`. The token\n     * is only sent to this origin or to one listed in `trustedOrigins`.\n     */\n    reference: string;\n    /** The CSRF config. `undefined` or `false` turns the header off. */\n    csrf: boolean | CsrfOptions | undefined;\n    /** Extra origins allowed to receive the token. */\n    trustedOrigins?: readonly string[];\n    /** Headers the caller already set. A CSRF header among them is never replaced. */\n    headers?: HeadersInit;\n}\n\n/**\n * The CSRF header a request should carry, or an empty object.\n *\n * Every request path in the SDK — `createApiClient`, `uploadWithProgress`,\n * `createResumableUpload` — asks this function, so the rules are one rule:\n *\n * - **Off unless configured.** Without `csrf`, nothing changes.\n * - **Unsafe methods only.** `GET`, `HEAD`, `OPTIONS` and `TRACE` never carry\n *   it; they must not change state, and a token in a `GET` ends up in logs\n *   and caches for nothing.\n * - **Never across an origin.** The token follows the same scope as the bearer\n *   credential ({@link isTrustedCredentialTarget}), because a URL can come off\n *   the network — a tus `Location`, a pagination link — and a CSRF token sent\n *   to a third party is a token that third party can replay. Withheld tokens\n *   are reported once per origin in a development build.\n * - **Your header wins.** A CSRF header you set by hand, in any casing, is\n *   left alone.\n * - **Independent of auth.** It is sent on `skipAuth` requests too: login and\n *   refresh are exactly the writes a cookie session exposes to forgery.\n *\n * Exported for the request you build by hand, so it follows the same rules.\n *\n * @example\n * const headers = csrfHeaders({\n *     method: \"POST\",\n *     url: \"https://api.acme.com/orders\",\n *     reference: \"https://api.acme.com\",\n *     csrf: true,\n * });\n * // { \"X-CSRF-Token\": \"<value of the csrf_token cookie>\" }\n *\n * @param input - The request and the CSRF config.\n * @returns A header record to spread into the request's headers.\n */\nexport function csrfHeaders(input: CsrfHeadersInput): Record<string, string> {\n    const { method, url, reference, csrf, trustedOrigins, headers } = input;\n    if (!csrf) return {};\n    if (SAFE_METHODS.has(method.toUpperCase())) return {};\n    const options: CsrfOptions = csrf === true ? {} : csrf;\n    const headerName = options.headerName ?? DEFAULT_CSRF_HEADER_NAME;\n    if (hasHeader(headers, headerName)) return {};\n    if (!isTrustedCredentialTarget(url, reference, trustedOrigins)) {\n        reportSuppressedCredential(url, reference, headerName);\n        return {};\n    }\n    const cookieName = options.cookieName ?? DEFAULT_CSRF_COOKIE_NAME;\n    const token = options.getToken ? options.getToken() : readCookie(cookieName);\n    if (!token) {\n        reportMissingToken(options.getToken ? \"getToken\" : cookieName);\n        return {};\n    }\n    return { [headerName]: token };\n}\n\n/**\n * Forget which token sources were already reported empty.\n *\n * Exported for tests, which assert the once-per-source behaviour and would\n * otherwise leak state between cases.\n */\nexport function resetCsrfReports(): void {\n    reportedMissing.clear();\n}\n"],"mappings":";;;AAYA,IAAa,IAA2B,cAQ3B,IAA2B,gBAwClC,oBAAoC,IAAI,IAAI;CAAC;CAAO;CAAQ;CAAW;AAAO,CAAC,GAG/E,oBAAkB,IAAI,IAAY;AAYxC,SAAS,EAAW,GAA6B;CAC7C,IAAI,OAAO,WAAa,KAAa,OAAO;CAC5C,IAAM,IAAS,GAAG,EAAK;CACvB,KAAK,IAAM,KAAQ,SAAS,OAAO,MAAM,GAAG,GAAG;EAC3C,IAAM,IAAQ,EAAK,KAAK;EACxB,IAAI,CAAC,EAAM,WAAW,CAAM,GAAG;EAC/B,IAAM,IAAM,EAAM,MAAM,EAAO,MAAM;EACrC,IAAI;GACA,OAAO,mBAAmB,CAAG;EACjC,QAAQ;GACJ,OAAO;EACX;CACJ;CACA,OAAO;AACX;AAcA,SAAS,EAAmB,GAAsB;CAC9C,IAAI,CAAC,EAAW,KAAK,EAAgB,IAAI,CAAM,GAAG;CAClD,EAAgB,IAAI,CAAM;CAC1B,IAAM,IACF,MAAW,aACL,qCACA,gBAAgB,EAAO;CACjC,QAAQ,KACJ,2CAA2C,EAAM,kHACrD;AACJ;AAaA,SAAS,EAAU,GAAkC,GAAuB;CAExE,OADK,IACE,IAAI,QAAQ,CAAO,CAAC,CAAC,IAAI,CAAI,IADf;AAEzB;AAuDA,SAAgB,EAAY,GAAiD;CACzE,IAAM,EAAE,WAAQ,QAAK,cAAW,SAAM,mBAAgB,eAAY;CAElE,IADI,CAAC,KACD,EAAa,IAAI,EAAO,YAAY,CAAC,GAAG,OAAO,CAAC;CACpD,IAAM,IAAuB,MAAS,KAAO,CAAC,IAAI,GAC5C,IAAa,EAAQ,cAAA;CAC3B,IAAI,EAAU,GAAS,CAAU,GAAG,OAAO,CAAC;CAC5C,IAAI,CAAC,EAA0B,GAAK,GAAW,CAAc,GAEzD,OADA,EAA2B,GAAK,GAAW,CAAU,GAC9C,CAAC;CAEZ,IAAM,IAAa,EAAQ,cAAA,cACrB,IAAQ,EAAQ,WAAW,EAAQ,SAAS,IAAI,EAAW,CAAU;CAK3E,OAJK,IAIE,GAAG,IAAa,EAAM,KAHzB,EAAmB,EAAQ,WAAW,aAAa,CAAU,GACtD,CAAC;AAGhB"}
+{"version":3,"file":"csrf.js","names":["DEFAULT_CSRF_COOKIE_NAME","DEFAULT_CSRF_HEADER_NAME","SAFE_METHODS","reportedMissing","readCookie","prefix","name","part","entry","raw","reportMissingToken","isDevBuild","source","where","hasHeader","headers","csrfHeaders","input","csrf","method","options","headerName","isTrustedCredentialTarget","url","reference","trustedOrigins","reportSuppressedCredential","cookieName","token"],"sources":["../../src/http/csrf.ts"],"sourcesContent":["import { isDevBuild } from \"../utils/dev-mode\";\nimport { isTrustedCredentialTarget, reportSuppressedCredential } from \"./credential-scope\";\n\n/**\n * Default cookie the CSRF token is read from.\n *\n * Ported from `tempest-fastapi-sdk`'s `CSRF_COOKIE_NAME`\n * (`tempest_fastapi_sdk/api/middlewares/csrf.py`), which is the cookie its\n * `make_csrf_token_dependency()` sets and its `CSRFMiddleware` compares against.\n * Matching it is what lets `csrf: true` work against that backend with no\n * configuration on either side.\n */\nexport const DEFAULT_CSRF_COOKIE_NAME = \"csrf_token\";\n\n/**\n * Default header the CSRF token is echoed in.\n *\n * Ported from `tempest-fastapi-sdk`'s `CSRF_HEADER_NAME`, the header its\n * `CSRFMiddleware` reads on every unsafe request.\n */\nexport const DEFAULT_CSRF_HEADER_NAME = \"X-CSRF-Token\";\n\n/**\n * Where the CSRF token comes from and which header carries it.\n *\n * The default is the **double-submit cookie**: the server sets a cookie that is\n * deliberately not `HttpOnly`, the client reads it and echoes the value in a\n * header, and the server rejects a write whose header does not match the\n * cookie. A page on another site can make the browser *send* the cookie, but\n * cannot *read* it, so it cannot write the header.\n *\n * The token is read again on every request, so a server that rotates the\n * cookie is followed without any capture step: the browser's cookie jar is the\n * store. That is also why there is no \"read the token from a response header\"\n * mode — it would depend on `Access-Control-Expose-Headers`, and a missing\n * expose header fails silently, as a `403` on the second write.\n */\nexport interface CsrfOptions {\n    /** Cookie to read the token from. Default {@link DEFAULT_CSRF_COOKIE_NAME}. */\n    cookieName?: string;\n    /** Header to send the token in. Default {@link DEFAULT_CSRF_HEADER_NAME}. */\n    headerName?: string;\n    /**\n     * Supply the token yourself instead of reading `cookieName`.\n     *\n     * For the cases the cookie cannot serve: an API on another **site**, whose\n     * cookie `document.cookie` cannot see, or a backend that hands the token\n     * out in a response body. Called per request, like `getToken`.\n     */\n    getToken?: () => string | null | undefined;\n}\n\n/**\n * Methods that must not change state, and so never carry the token.\n *\n * A deny list rather than an allow list of the four write verbs: RFC 9110\n * names the safe methods, and a custom method (`PROPFIND`, a tus extension)\n * is a write until proven otherwise. Sending the token to its own origin on\n * an unexpected verb costs nothing; omitting it costs a `403`.\n */\nconst SAFE_METHODS: ReadonlySet<string> = new Set([\"GET\", \"HEAD\", \"OPTIONS\", \"TRACE\"]);\n\n/** Token sources already reported empty, so a burst of writes warns once. */\nconst reportedMissing = new Set<string>();\n\n/**\n * Read one cookie from `document.cookie`, or `null` when it is absent.\n *\n * Returns `null` outside a document (a worker, a test without jsdom), where\n * there is no cookie jar to read. The value is URI-decoded when it can be,\n * and returned raw when it is not valid percent-encoding.\n *\n * @param name - The cookie name.\n * @returns The value, or `null`.\n */\nfunction readCookie(name: string): string | null {\n    if (typeof document === \"undefined\") return null;\n    const prefix = `${name}=`;\n    for (const part of document.cookie.split(\";\")) {\n        const entry = part.trim();\n        if (!entry.startsWith(prefix)) continue;\n        const raw = entry.slice(prefix.length);\n        try {\n            return decodeURIComponent(raw);\n        } catch {\n            return raw;\n        }\n    }\n    return null;\n}\n\n/**\n * Say once, in a development build, that CSRF is on but there is no token.\n *\n * The request still goes out, because the SDK cannot know whether this path\n * is guarded — `CSRFMiddleware` is commonly mounted with `exclude_paths`. When\n * it is guarded, the symptom is a `403 CSRF_VALIDATION_FAILED` with nothing\n * in the app's code pointing at the cause, and the three usual causes are all\n * on the server: the cookie was never issued, was issued `HttpOnly`, or was\n * issued for a domain this page cannot read.\n *\n * @param source - What was read: the cookie name, or `\"getToken\"`.\n */\nfunction reportMissingToken(source: string): void {\n    if (!isDevBuild() || reportedMissing.has(source)) return;\n    reportedMissing.add(source);\n    const where =\n        source === \"getToken\"\n            ? \"csrf.getToken() returned nothing\"\n            : `no readable \"${source}\" cookie on this page`;\n    console.warn(\n        `[tempest-react-sdk] CSRF is enabled but ${where}, so the write went without the token. The cookie must be issued before the first write and must not be HttpOnly.`,\n    );\n}\n\n/**\n * Whether a header is already present, compared case-insensitively.\n *\n * Header names are case-insensitive, but object keys are not: a caller's\n * `\"x-csrf-token\"` next to the SDK's `\"X-CSRF-Token\"` would reach `fetch` as\n * two entries and be joined into `\"a, b\"`, which matches neither.\n *\n * @param headers - The headers the caller already set.\n * @param name - The header to look for.\n * @returns Whether it is set.\n */\nfunction hasHeader(headers: HeadersInit | undefined, name: string): boolean {\n    if (!headers) return false;\n    return new Headers(headers).has(name);\n}\n\n/** What {@link csrfHeaders} needs to decide. */\nexport interface CsrfHeadersInput {\n    /** The HTTP method of the request. Case-insensitive. */\n    method: string;\n    /** The URL the request is going to. */\n    url: string;\n    /**\n     * The origin the token belongs to, normally the API's `baseURL`. The token\n     * is only sent to this origin or to one listed in `trustedOrigins`.\n     */\n    reference: string;\n    /** The CSRF config. `undefined` or `false` turns the header off. */\n    csrf: boolean | CsrfOptions | undefined;\n    /** Extra origins allowed to receive the token. */\n    trustedOrigins?: readonly string[];\n    /** Headers the caller already set. A CSRF header among them is never replaced. */\n    headers?: HeadersInit;\n}\n\n/**\n * The CSRF header a request should carry, or an empty object.\n *\n * Every request path in the SDK — `createApiClient`, `uploadWithProgress`,\n * `createResumableUpload` — asks this function, so the rules are one rule:\n *\n * - **Off unless configured.** Without `csrf`, nothing changes.\n * - **Unsafe methods only.** `GET`, `HEAD`, `OPTIONS` and `TRACE` never carry\n *   it; they must not change state, and a token in a `GET` ends up in logs\n *   and caches for nothing.\n * - **Never across an origin.** The token follows the same scope as the bearer\n *   credential ({@link isTrustedCredentialTarget}), because a URL can come off\n *   the network — a tus `Location`, a pagination link — and a CSRF token sent\n *   to a third party is a token that third party can replay. Withheld tokens\n *   are reported once per origin in a development build.\n * - **Your header wins.** A CSRF header you set by hand, in any casing, is\n *   left alone.\n * - **Independent of auth.** It is sent on `skipAuth` requests too: login and\n *   refresh are exactly the writes a cookie session exposes to forgery.\n *\n * Exported for the request you build by hand, so it follows the same rules.\n *\n * @example\n * const headers = csrfHeaders({\n *     method: \"POST\",\n *     url: \"https://api.acme.com/orders\",\n *     reference: \"https://api.acme.com\",\n *     csrf: true,\n * });\n * // { \"X-CSRF-Token\": \"<value of the csrf_token cookie>\" }\n *\n * @param input - The request and the CSRF config.\n * @returns A header record to spread into the request's headers.\n */\nexport function csrfHeaders(input: CsrfHeadersInput): Record<string, string> {\n    const { method, url, reference, csrf, trustedOrigins, headers } = input;\n    if (!csrf) return {};\n    if (SAFE_METHODS.has(method.toUpperCase())) return {};\n    const options: CsrfOptions = csrf === true ? {} : csrf;\n    const headerName = options.headerName ?? DEFAULT_CSRF_HEADER_NAME;\n    if (hasHeader(headers, headerName)) return {};\n    if (!isTrustedCredentialTarget(url, reference, trustedOrigins)) {\n        reportSuppressedCredential(url, reference, headerName);\n        return {};\n    }\n    const cookieName = options.cookieName ?? DEFAULT_CSRF_COOKIE_NAME;\n    const token = options.getToken ? options.getToken() : readCookie(cookieName);\n    if (!token) {\n        reportMissingToken(options.getToken ? \"getToken\" : cookieName);\n        return {};\n    }\n    return { [headerName]: token };\n}\n\n/**\n * Forget which token sources were already reported empty.\n *\n * Exported for tests, which assert the once-per-source behaviour and would\n * otherwise leak state between cases.\n */\nexport function resetCsrfReports(): void {\n    reportedMissing.clear();\n}\n"],"mappings":";;;AAYA,IAAaA,IAA2B,cAQ3BC,IAA2B,gBAwClCC,oBAAoC,IAAI,IAAI;CAAC;CAAO;CAAQ;CAAW;AAAO,CAAC,GAG/EC,oBAAkB,IAAI,IAAY;AAYxC,SAASC,EAAW,GAA6B;CAC7C,IAAI,OAAO,WAAa,KAAa,OAAO;CAC5C,IAAMC,IAAS,GAAGC,EAAK;CACvB,KAAK,IAAMC,KAAQ,SAAS,OAAO,MAAM,GAAG,GAAG;EAC3C,IAAMC,IAAQD,EAAK,KAAK;EACxB,IAAI,CAACC,EAAM,WAAWH,CAAM,GAAG;EAC/B,IAAMI,IAAMD,EAAM,MAAMH,EAAO,MAAM;EACrC,IAAI;GACA,OAAO,mBAAmBI,CAAG;EACjC,QAAQ;GACJ,OAAOA;EACX;CACJ;CACA,OAAO;AACX;AAcA,SAASC,EAAmB,GAAsB;CAC9C,IAAI,CAACC,EAAW,KAAKR,EAAgB,IAAIS,CAAM,GAAG;CAClD,EAAgB,IAAIA,CAAM;CAC1B,IAAMC,IACFD,MAAW,aACL,qCACA,gBAAgBA,EAAO;CACjC,QAAQ,KACJ,2CAA2CC,EAAM,kHACrD;AACJ;AAaA,SAASC,EAAU,GAAkC,GAAuB;CAExE,OADKC,IACE,IAAI,QAAQA,CAAO,CAAC,CAAC,IAAIT,CAAI,IADf;AAEzB;AAuDA,SAAgBU,EAAY,GAAiD;CACzE,IAAM,EAAE,WAAQ,QAAK,cAAW,SAAM,mBAAgB,eAAYC;CAElE,IADI,CAACC,KACDhB,EAAa,IAAIiB,EAAO,YAAY,CAAC,GAAG,OAAO,CAAC;CACpD,IAAMC,IAAuBF,MAAS,KAAO,CAAC,IAAIA,GAC5CG,IAAaD,EAAQ,cAAA;CAC3B,IAAIN,EAAUC,GAASM,CAAU,GAAG,OAAO,CAAC;CAC5C,IAAI,CAACC,EAA0BC,GAAKC,GAAWC,CAAc,GAEzD,OADAC,EAA2BH,GAAKC,GAAWH,CAAU,GAC9C,CAAC;CAEZ,IAAMM,IAAaP,EAAQ,cAAA,cACrBQ,IAAQR,EAAQ,WAAWA,EAAQ,SAAS,IAAIhB,EAAWuB,CAAU;CAK3E,OAJKC,IAIE,GAAGP,IAAaO,EAAM,KAHzBlB,EAAmBU,EAAQ,WAAW,aAAaO,CAAU,GACtD,CAAC;AAGhB"}

package/dist/http/decode-response.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"decode-response.cjs","names":[],"sources":["../../src/http/decode-response.ts"],"sourcesContent":["import { isDevBuild } from \"../utils/dev-mode\";\n\n/**\n * Media-type fragments that name something safe to read as text, for the types\n * that do not open with `text/` — `application/xml`, `application/javascript`,\n * `application/x-www-form-urlencoded`.\n */\nconst TEXTUAL_TOKENS: readonly string[] = [\"xml\", \"javascript\", \"ecmascript\", \"urlencoded\", \"csv\"];\n\n/** How a {@link createApiClient} response body becomes the value a caller awaited. */\nexport type ResponseDecoder<T> = (response: Response) => Promise<T>;\n\n/**\n * Whether a `Content-Type` names a JSON dialect.\n *\n * Matches the suffix forms as well as the plain one, so `application/json`,\n * `application/problem+json` (RFC 9457, what a FastAPI error handler sends) and\n * `application/vnd.tempest.v2+json` all decode as JSON instead of falling\n * through to text.\n *\n * @param contentType - The raw header value, possibly with parameters.\n * @returns Whether the body should be read with `response.json()`.\n */\nexport function isJsonContentType(contentType: string): boolean {\n    return contentType.toLowerCase().includes(\"json\");\n}\n\n/**\n * Whether a `Content-Type` names something that survives being read as text.\n *\n * An absent header counts as textual: a backend that answers without one is\n * almost always sending text, and treating it as binary would change what\n * existing callers get back for no measured gain.\n *\n * @param contentType - The raw header value, possibly with parameters.\n * @returns Whether the body should be read with `response.text()`.\n */\nexport function isTextualContentType(contentType: string): boolean {\n    const type = contentType.trim().toLowerCase();\n    if (type === \"\") return true;\n    if (type.startsWith(\"text/\")) return true;\n    return TEXTUAL_TOKENS.some((token) => type.includes(token));\n}\n\n/**\n * Warn, in a development build, that a binary body reached the JSON/text path.\n *\n * @param contentType - The `Content-Type` that was decoded as a `Blob`.\n */\nfunction warnBinaryBody(contentType: string): void {\n    if (!isDevBuild()) return;\n    console.warn(\n        `[tempest] <ApiClient> received a binary response (content-type: ${contentType}) and returned a Blob. ` +\n            \"Call `client.blob()` or `client.arrayBuffer()` so the type matches what arrives.\",\n    );\n}\n\n/**\n * Decode a response the way its `Content-Type` asks to be decoded.\n *\n * JSON is parsed, text is read as text, and **everything else comes back as a\n * `Blob`**. That last branch is the fix for a silent data defect: the client\n * used to fall back to `response.text()` for any non-JSON body, so an\n * `image/jpeg` was decoded as UTF-8 and the bytes were destroyed on the way in.\n * Measured on a bare JPEG header — `ff d8 ff e0 00 10 4a 46 49 46` — the\n * round-trip through text returns 18 bytes for the 10 that arrived, 4 of them\n * replaced by `U+FFFD`. No caller can undo that, which is why the download had\n * to leave the client entirely.\n *\n * A `204` has no body at all and resolves to `undefined`, whatever the headers\n * claim.\n *\n * @typeParam T - What the caller expects back.\n * @param response - A response already known to be successful.\n * @returns The decoded body.\n */\nexport async function decodeByContentType<T>(response: Response): Promise<T> {\n    if (response.status === 204) {\n        return undefined as T;\n    }\n\n    const contentType = response.headers.get(\"content-type\") ?? \"\";\n    if (isJsonContentType(contentType)) {\n        return (await response.json()) as T;\n    }\n    if (isTextualContentType(contentType)) {\n        return (await response.text()) as unknown as T;\n    }\n\n    warnBinaryBody(contentType);\n    return (await response.blob()) as unknown as T;\n}\n"],"mappings":"yCAOA,IAAM,EAAoC,CAAC,MAAO,aAAc,aAAc,aAAc,KAAK,EAgBjG,SAAgB,EAAkB,EAA8B,CAC5D,OAAO,EAAY,YAAY,CAAC,CAAC,SAAS,MAAM,CACpD,CAYA,SAAgB,EAAqB,EAA8B,CAC/D,IAAM,EAAO,EAAY,KAAK,CAAC,CAAC,YAAY,EAG5C,OAFI,IAAS,IACT,EAAK,WAAW,OAAO,EAAU,GAC9B,EAAe,KAAM,GAAU,EAAK,SAAS,CAAK,CAAC,CAC9D,CAOA,SAAS,EAAe,EAA2B,CAC1C,EAAA,WAAW,GAChB,QAAQ,KACJ,mEAAmE,EAAY,4GAEnF,CACJ,CAqBA,eAAsB,EAAuB,EAAgC,CACzE,GAAI,EAAS,SAAW,IACpB,OAGJ,IAAM,EAAc,EAAS,QAAQ,IAAI,cAAc,GAAK,GAS5D,OARI,EAAkB,CAAW,EACrB,MAAM,EAAS,KAAK,EAE5B,EAAqB,CAAW,EACxB,MAAM,EAAS,KAAK,GAGhC,EAAe,CAAW,EAClB,MAAM,EAAS,KAAK,EAChC"}
+{"version":3,"file":"decode-response.cjs","names":["isDevBuild","require_dev_mode","TEXTUAL_TOKENS","isJsonContentType","contentType","isTextualContentType","type","token","warnBinaryBody","decodeByContentType","response"],"sources":["../../src/http/decode-response.ts"],"sourcesContent":["import { isDevBuild } from \"../utils/dev-mode\";\n\n/**\n * Media-type fragments that name something safe to read as text, for the types\n * that do not open with `text/` — `application/xml`, `application/javascript`,\n * `application/x-www-form-urlencoded`.\n */\nconst TEXTUAL_TOKENS: readonly string[] = [\"xml\", \"javascript\", \"ecmascript\", \"urlencoded\", \"csv\"];\n\n/** How a {@link createApiClient} response body becomes the value a caller awaited. */\nexport type ResponseDecoder<T> = (response: Response) => Promise<T>;\n\n/**\n * Whether a `Content-Type` names a JSON dialect.\n *\n * Matches the suffix forms as well as the plain one, so `application/json`,\n * `application/problem+json` (RFC 9457, what a FastAPI error handler sends) and\n * `application/vnd.tempest.v2+json` all decode as JSON instead of falling\n * through to text.\n *\n * @param contentType - The raw header value, possibly with parameters.\n * @returns Whether the body should be read with `response.json()`.\n */\nexport function isJsonContentType(contentType: string): boolean {\n    return contentType.toLowerCase().includes(\"json\");\n}\n\n/**\n * Whether a `Content-Type` names something that survives being read as text.\n *\n * An absent header counts as textual: a backend that answers without one is\n * almost always sending text, and treating it as binary would change what\n * existing callers get back for no measured gain.\n *\n * @param contentType - The raw header value, possibly with parameters.\n * @returns Whether the body should be read with `response.text()`.\n */\nexport function isTextualContentType(contentType: string): boolean {\n    const type = contentType.trim().toLowerCase();\n    if (type === \"\") return true;\n    if (type.startsWith(\"text/\")) return true;\n    return TEXTUAL_TOKENS.some((token) => type.includes(token));\n}\n\n/**\n * Warn, in a development build, that a binary body reached the JSON/text path.\n *\n * @param contentType - The `Content-Type` that was decoded as a `Blob`.\n */\nfunction warnBinaryBody(contentType: string): void {\n    if (!isDevBuild()) return;\n    console.warn(\n        `[tempest] <ApiClient> received a binary response (content-type: ${contentType}) and returned a Blob. ` +\n            \"Call `client.blob()` or `client.arrayBuffer()` so the type matches what arrives.\",\n    );\n}\n\n/**\n * Decode a response the way its `Content-Type` asks to be decoded.\n *\n * JSON is parsed, text is read as text, and **everything else comes back as a\n * `Blob`**. That last branch is the fix for a silent data defect: the client\n * used to fall back to `response.text()` for any non-JSON body, so an\n * `image/jpeg` was decoded as UTF-8 and the bytes were destroyed on the way in.\n * Measured on a bare JPEG header — `ff d8 ff e0 00 10 4a 46 49 46` — the\n * round-trip through text returns 18 bytes for the 10 that arrived, 4 of them\n * replaced by `U+FFFD`. No caller can undo that, which is why the download had\n * to leave the client entirely.\n *\n * A `204` has no body at all and resolves to `undefined`, whatever the headers\n * claim.\n *\n * @typeParam T - What the caller expects back.\n * @param response - A response already known to be successful.\n * @returns The decoded body.\n */\nexport async function decodeByContentType<T>(response: Response): Promise<T> {\n    if (response.status === 204) {\n        return undefined as T;\n    }\n\n    const contentType = response.headers.get(\"content-type\") ?? \"\";\n    if (isJsonContentType(contentType)) {\n        return (await response.json()) as T;\n    }\n    if (isTextualContentType(contentType)) {\n        return (await response.text()) as unknown as T;\n    }\n\n    warnBinaryBody(contentType);\n    return (await response.blob()) as unknown as T;\n}\n"],"mappings":"A,yCAOA,IAAME,EAAoC,CAAC,MAAO,aAAc,aAAc,aAAc,KAAK,EAgBjG,SAAgBC,EAAkB,EAA8B,CAC5D,OAAOC,EAAY,YAAY,CAAC,CAAC,SAAS,MAAM,CACpD,CAYA,SAAgBC,EAAqB,EAA8B,CAC/D,IAAMC,EAAOF,EAAY,KAAK,CAAC,CAAC,YAAY,EAG5C,OAFIE,IAAS,IACTA,EAAK,WAAW,OAAO,EAAU,GAC9BJ,EAAe,KAAM,GAAUI,EAAK,SAASC,CAAK,CAAC,CAC9D,CAOA,SAASC,EAAe,EAA2B,CAC1CR,EAAAA,WAAW,GAChB,QAAQ,KACJ,mEAAmEI,EAAY,4GAEnF,CACJ,CAqBA,eAAsBK,EAAuB,EAAgC,CACzE,GAAIC,EAAS,SAAW,IACpB,OAGJ,IAAMN,EAAcM,EAAS,QAAQ,IAAI,cAAc,GAAK,GAS5D,OARIP,EAAkBC,CAAW,EACrB,MAAMM,EAAS,KAAK,EAE5BL,EAAqBD,CAAW,EACxB,MAAMM,EAAS,KAAK,GAGhCF,EAAeJ,CAAW,EAClB,MAAMM,EAAS,KAAK,EAChC,C"}

package/dist/http/decode-response.js.map

@@ -1 +1 @@
-{"version":3,"file":"decode-response.js","names":[],"sources":["../../src/http/decode-response.ts"],"sourcesContent":["import { isDevBuild } from \"../utils/dev-mode\";\n\n/**\n * Media-type fragments that name something safe to read as text, for the types\n * that do not open with `text/` — `application/xml`, `application/javascript`,\n * `application/x-www-form-urlencoded`.\n */\nconst TEXTUAL_TOKENS: readonly string[] = [\"xml\", \"javascript\", \"ecmascript\", \"urlencoded\", \"csv\"];\n\n/** How a {@link createApiClient} response body becomes the value a caller awaited. */\nexport type ResponseDecoder<T> = (response: Response) => Promise<T>;\n\n/**\n * Whether a `Content-Type` names a JSON dialect.\n *\n * Matches the suffix forms as well as the plain one, so `application/json`,\n * `application/problem+json` (RFC 9457, what a FastAPI error handler sends) and\n * `application/vnd.tempest.v2+json` all decode as JSON instead of falling\n * through to text.\n *\n * @param contentType - The raw header value, possibly with parameters.\n * @returns Whether the body should be read with `response.json()`.\n */\nexport function isJsonContentType(contentType: string): boolean {\n    return contentType.toLowerCase().includes(\"json\");\n}\n\n/**\n * Whether a `Content-Type` names something that survives being read as text.\n *\n * An absent header counts as textual: a backend that answers without one is\n * almost always sending text, and treating it as binary would change what\n * existing callers get back for no measured gain.\n *\n * @param contentType - The raw header value, possibly with parameters.\n * @returns Whether the body should be read with `response.text()`.\n */\nexport function isTextualContentType(contentType: string): boolean {\n    const type = contentType.trim().toLowerCase();\n    if (type === \"\") return true;\n    if (type.startsWith(\"text/\")) return true;\n    return TEXTUAL_TOKENS.some((token) => type.includes(token));\n}\n\n/**\n * Warn, in a development build, that a binary body reached the JSON/text path.\n *\n * @param contentType - The `Content-Type` that was decoded as a `Blob`.\n */\nfunction warnBinaryBody(contentType: string): void {\n    if (!isDevBuild()) return;\n    console.warn(\n        `[tempest] <ApiClient> received a binary response (content-type: ${contentType}) and returned a Blob. ` +\n            \"Call `client.blob()` or `client.arrayBuffer()` so the type matches what arrives.\",\n    );\n}\n\n/**\n * Decode a response the way its `Content-Type` asks to be decoded.\n *\n * JSON is parsed, text is read as text, and **everything else comes back as a\n * `Blob`**. That last branch is the fix for a silent data defect: the client\n * used to fall back to `response.text()` for any non-JSON body, so an\n * `image/jpeg` was decoded as UTF-8 and the bytes were destroyed on the way in.\n * Measured on a bare JPEG header — `ff d8 ff e0 00 10 4a 46 49 46` — the\n * round-trip through text returns 18 bytes for the 10 that arrived, 4 of them\n * replaced by `U+FFFD`. No caller can undo that, which is why the download had\n * to leave the client entirely.\n *\n * A `204` has no body at all and resolves to `undefined`, whatever the headers\n * claim.\n *\n * @typeParam T - What the caller expects back.\n * @param response - A response already known to be successful.\n * @returns The decoded body.\n */\nexport async function decodeByContentType<T>(response: Response): Promise<T> {\n    if (response.status === 204) {\n        return undefined as T;\n    }\n\n    const contentType = response.headers.get(\"content-type\") ?? \"\";\n    if (isJsonContentType(contentType)) {\n        return (await response.json()) as T;\n    }\n    if (isTextualContentType(contentType)) {\n        return (await response.text()) as unknown as T;\n    }\n\n    warnBinaryBody(contentType);\n    return (await response.blob()) as unknown as T;\n}\n"],"mappings":";;AAOA,IAAM,IAAoC;CAAC;CAAO;CAAc;CAAc;CAAc;AAAK;AAgBjG,SAAgB,EAAkB,GAA8B;CAC5D,OAAO,EAAY,YAAY,CAAC,CAAC,SAAS,MAAM;AACpD;AAYA,SAAgB,EAAqB,GAA8B;CAC/D,IAAM,IAAO,EAAY,KAAK,CAAC,CAAC,YAAY;CAG5C,OAFI,MAAS,MACT,EAAK,WAAW,OAAO,IAAU,KAC9B,EAAe,MAAM,MAAU,EAAK,SAAS,CAAK,CAAC;AAC9D;AAOA,SAAS,EAAe,GAA2B;CAC1C,EAAW,KAChB,QAAQ,KACJ,mEAAmE,EAAY,4GAEnF;AACJ;AAqBA,eAAsB,EAAuB,GAAgC;CACzE,IAAI,EAAS,WAAW,KACpB;CAGJ,IAAM,IAAc,EAAS,QAAQ,IAAI,cAAc,KAAK;CAS5D,OARI,EAAkB,CAAW,IACrB,MAAM,EAAS,KAAK,IAE5B,EAAqB,CAAW,IACxB,MAAM,EAAS,KAAK,KAGhC,EAAe,CAAW,GAClB,MAAM,EAAS,KAAK;AAChC"}
+{"version":3,"file":"decode-response.js","names":["TEXTUAL_TOKENS","isJsonContentType","contentType","isTextualContentType","type","token","warnBinaryBody","isDevBuild","decodeByContentType","response"],"sources":["../../src/http/decode-response.ts"],"sourcesContent":["import { isDevBuild } from \"../utils/dev-mode\";\n\n/**\n * Media-type fragments that name something safe to read as text, for the types\n * that do not open with `text/` — `application/xml`, `application/javascript`,\n * `application/x-www-form-urlencoded`.\n */\nconst TEXTUAL_TOKENS: readonly string[] = [\"xml\", \"javascript\", \"ecmascript\", \"urlencoded\", \"csv\"];\n\n/** How a {@link createApiClient} response body becomes the value a caller awaited. */\nexport type ResponseDecoder<T> = (response: Response) => Promise<T>;\n\n/**\n * Whether a `Content-Type` names a JSON dialect.\n *\n * Matches the suffix forms as well as the plain one, so `application/json`,\n * `application/problem+json` (RFC 9457, what a FastAPI error handler sends) and\n * `application/vnd.tempest.v2+json` all decode as JSON instead of falling\n * through to text.\n *\n * @param contentType - The raw header value, possibly with parameters.\n * @returns Whether the body should be read with `response.json()`.\n */\nexport function isJsonContentType(contentType: string): boolean {\n    return contentType.toLowerCase().includes(\"json\");\n}\n\n/**\n * Whether a `Content-Type` names something that survives being read as text.\n *\n * An absent header counts as textual: a backend that answers without one is\n * almost always sending text, and treating it as binary would change what\n * existing callers get back for no measured gain.\n *\n * @param contentType - The raw header value, possibly with parameters.\n * @returns Whether the body should be read with `response.text()`.\n */\nexport function isTextualContentType(contentType: string): boolean {\n    const type = contentType.trim().toLowerCase();\n    if (type === \"\") return true;\n    if (type.startsWith(\"text/\")) return true;\n    return TEXTUAL_TOKENS.some((token) => type.includes(token));\n}\n\n/**\n * Warn, in a development build, that a binary body reached the JSON/text path.\n *\n * @param contentType - The `Content-Type` that was decoded as a `Blob`.\n */\nfunction warnBinaryBody(contentType: string): void {\n    if (!isDevBuild()) return;\n    console.warn(\n        `[tempest] <ApiClient> received a binary response (content-type: ${contentType}) and returned a Blob. ` +\n            \"Call `client.blob()` or `client.arrayBuffer()` so the type matches what arrives.\",\n    );\n}\n\n/**\n * Decode a response the way its `Content-Type` asks to be decoded.\n *\n * JSON is parsed, text is read as text, and **everything else comes back as a\n * `Blob`**. That last branch is the fix for a silent data defect: the client\n * used to fall back to `response.text()` for any non-JSON body, so an\n * `image/jpeg` was decoded as UTF-8 and the bytes were destroyed on the way in.\n * Measured on a bare JPEG header — `ff d8 ff e0 00 10 4a 46 49 46` — the\n * round-trip through text returns 18 bytes for the 10 that arrived, 4 of them\n * replaced by `U+FFFD`. No caller can undo that, which is why the download had\n * to leave the client entirely.\n *\n * A `204` has no body at all and resolves to `undefined`, whatever the headers\n * claim.\n *\n * @typeParam T - What the caller expects back.\n * @param response - A response already known to be successful.\n * @returns The decoded body.\n */\nexport async function decodeByContentType<T>(response: Response): Promise<T> {\n    if (response.status === 204) {\n        return undefined as T;\n    }\n\n    const contentType = response.headers.get(\"content-type\") ?? \"\";\n    if (isJsonContentType(contentType)) {\n        return (await response.json()) as T;\n    }\n    if (isTextualContentType(contentType)) {\n        return (await response.text()) as unknown as T;\n    }\n\n    warnBinaryBody(contentType);\n    return (await response.blob()) as unknown as T;\n}\n"],"mappings":";;AAOA,IAAMA,IAAoC;CAAC;CAAO;CAAc;CAAc;CAAc;AAAK;AAgBjG,SAAgBC,EAAkB,GAA8B;CAC5D,OAAOC,EAAY,YAAY,CAAC,CAAC,SAAS,MAAM;AACpD;AAYA,SAAgBC,EAAqB,GAA8B;CAC/D,IAAMC,IAAOF,EAAY,KAAK,CAAC,CAAC,YAAY;CAG5C,OAFIE,MAAS,MACTA,EAAK,WAAW,OAAO,IAAU,KAC9BJ,EAAe,MAAM,MAAUI,EAAK,SAASC,CAAK,CAAC;AAC9D;AAOA,SAASC,EAAe,GAA2B;CAC/C,AAAKC,EAAW,KAChB,QAAQ,KACJ,mEAAmEL,EAAY,4GAEnF;AACJ;AAqBA,eAAsBM,EAAuB,GAAgC;CACzE,IAAIC,EAAS,WAAW,KACpB;CAGJ,IAAMP,IAAcO,EAAS,QAAQ,IAAI,cAAc,KAAK;CAS5D,OARIR,EAAkBC,CAAW,IACrB,MAAMO,EAAS,KAAK,IAE5BN,EAAqBD,CAAW,IACxB,MAAMO,EAAS,KAAK,KAGhCH,EAAeJ,CAAW,GAClB,MAAMO,EAAS,KAAK;AAChC"}

package/dist/http/describe-api-error.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"describe-api-error.cjs","names":[],"sources":["../../src/http/describe-api-error.ts"],"sourcesContent":["// The last mile of error handling: a typed error is what code reads, a sentence\n// is what a person reads, and every app was writing the funnel between the two.\n// The case everyone forgets is the request that never reached the server, which\n// without special handling renders as the nonsense \"erro 0\".\n\nimport { isApiError, syntheticDetail } from \"./errors\";\n\n/** The fixed sentences {@link describeApiError} may need. */\nexport interface ApiErrorStrings {\n    /** Shown when the request never reached the server. */\n    offline: string;\n    /**\n     * Shown when the backend rejected the payload field by field.\n     *\n     * The per-field messages are on `error.fields`, to be attached to the inputs\n     * themselves; this sentence is what the toast says.\n     *\n     * It does not apply to the one rejection that named a single field with a\n     * finished sentence — there the server's own `detail` is shown instead, since\n     * it is the same string `fields` carries. Pass `useDetail: false` to force\n     * this sentence in that case too.\n     */\n    validation: string;\n}\n\n/**\n * PT-BR defaults, used when no strings are supplied and no catalog answers.\n *\n * The SDK's copy is pt-BR everywhere else (`FilterBar`, `DataTable`, `Chat`), so\n * the default here matches rather than introducing an English string that only\n * shows up on a network failure.\n */\nexport const DEFAULT_API_ERROR_STRINGS: ApiErrorStrings = {\n    offline: \"Sem conexão com o servidor. Verifique sua internet e tente de novo.\",\n    validation: \"Confira os campos destacados e tente de novo.\",\n};\n\n/**\n * Translation key the {@link useDescribeApiError} hook looks up.\n *\n * A catalog that does not define it falls back to\n * {@link DEFAULT_API_ERROR_STRINGS}, because `t` returns the key itself when the\n * lookup misses and printing `tempest.error.offline` at the user would be worse\n * than printing pt-BR at them.\n */\nexport const API_ERROR_OFFLINE_KEY = \"tempest.error.offline\";\n\n/**\n * Translation key for the validation sentence, looked up the same way as\n * {@link API_ERROR_OFFLINE_KEY}.\n */\nexport const API_ERROR_VALIDATION_KEY = \"tempest.error.validation\";\n\n/**\n * Everything {@link describeApiError} accepts beyond the error and the fallback.\n *\n * Extends the fixed sentences rather than sitting beside them, so a caller that\n * already passed `{ offline, validation }` keeps compiling untouched.\n */\nexport interface DescribeApiErrorOptions extends Partial<ApiErrorStrings> {\n    /**\n     * Maps the backend's programmatic `code` to a sentence in your language.\n     *\n     * The client already surfaces `code` on `ApiError`, but without this every\n     * app writes the same `switch` over it. A hit here wins over every other\n     * step: it is the only sentence written for that exact case, by someone who\n     * knew both the backend contract and the screen it lands on.\n     */\n    codes?: Readonly<Record<string, string>>;\n    /**\n     * Maps an HTTP status to a sentence, for the failures that arrive with no\n     * useful body.\n     *\n     * `codes` covers the cases the backend named; this covers the ones it did\n     * not. The reference case is the `403` of an admin-only route: the body\n     * carries a generic `detail` (or none), so the funnel fell through to the\n     * fallback and an administrator read \"Não foi possível carregar\" when the\n     * fact that answers their question is \"esta listagem é só para\n     * administradores\".\n     *\n     * Checked after `codes` and **before** the backend's `detail`: a generic\n     * sentence emitted by the framework is worse than the one the app wrote for\n     * that status. `useDetail: false` remains the way to suppress `detail`\n     * entirely.\n     *\n     * A `0` key is honoured like any other, ahead of the offline sentence —\n     * `statuses` is the caller's explicit map, and the fixed `offline` string is\n     * already the way to reword that case. Status `0` covers a request that\n     * never landed **and** one abandoned by the client timeout, so an app that\n     * maps it is taking both.\n     */\n    statuses?: Readonly<Record<number, string>>;\n    /**\n     * Whether the backend's `detail` may be shown when no `code` matched.\n     * Default `true`.\n     *\n     * Set it to `false` when `detail` is written for developers rather than\n     * users, or when it could echo internals — the result is then always either\n     * a sentence you wrote or the fallback.\n     */\n    useDetail?: boolean;\n}\n\n/**\n * Whether the browser currently reports itself as offline.\n *\n * `fetch` rejects a network failure with a plain `TypeError` whose message\n * differs per browser (\"Failed to fetch\", \"NetworkError when attempting to fetch\n * resource.\", \"Load failed\"), so sniffing the message is not portable. The online\n * flag is, and it is the signal that matters for the sentence being chosen.\n *\n * @returns `true` only when the environment positively says it is offline.\n */\nfunction browserIsOffline(): boolean {\n    return typeof navigator !== \"undefined\" && navigator.onLine === false;\n}\n\n/**\n * Whether `fields` is the flattened single-field envelope, carrying `detail`.\n *\n * The check is identity rather than shape-sniffing. `collectFields` has exactly\n * two sources: FastAPI's `detail` **list**, whose entries are the per-issue\n * messages, and the flattened envelope, whose one entry is built from the same\n * string that becomes `ApiError.detail`. So one entry equal to `detail` can only\n * have come from the second, and returning `detail` there shows the string the\n * form is already about to attach to that input.\n *\n * @param fields - The error's field messages.\n * @param detail - `error.detail`, already trimmed.\n * @param status - The HTTP status, to recognise the synthetic `Erro <status>`\n *     that stands in when the body carried no message at all.\n * @returns Whether `detail` is safe to show as the sentence.\n */\nfunction singleFieldSentence(\n    fields: Record<string, string>,\n    detail: string,\n    status: number,\n): boolean {\n    if (detail === \"\" || detail === syntheticDetail(status)) return false;\n    const messages = Object.values(fields);\n    return messages.length === 1 && messages[0].trim() === detail;\n}\n\n/**\n * Turn any caught value into a sentence worth showing.\n *\n * The funnel, in order:\n *\n * 0. `codes[error.code]` — the sentence you wrote for that exact backend case.\n *    Checked first because nothing the funnel derives can beat it, and because a\n *    request that never landed carries no `code` for it to shadow.\n * 0.5. `statuses[error.status]` — the sentence for a whole class of failure,\n *    for the errors that arrive with no useful body. It beats the backend's\n *    `detail`, because a generic line emitted by the framework is worse than the\n *    one the app wrote for that status, and it beats the offline sentence when\n *    the caller maps `0` explicitly.\n * 1. A request that never reached the server — `status === 0`, or a non-API\n *    error thrown while the browser reports itself offline — produces the\n *    offline sentence. This is the step apps skip, and skipping it renders\n *    \"erro 0\" or a raw `TypeError` at the user.\n * 2. A validation rejection — `error.fields` is set — produces the validation\n *    sentence, **not** `detail`. On a FastAPI `422` the `detail` line is assembled\n *    from the backend's field paths and the validator's own wording\n *    (`\"items.0.price: Input should be greater than 0\"`), which is right for a\n *    log and wrong for a person: it is half English in a pt-BR screen and it\n *    names internals. The per-field messages stay on `fields`, where a form can\n *    attach them to the inputs that failed.\n *\n *    **Unless the rejection named exactly one field and its message is\n *    `detail` itself**, in which case `detail` is returned. That is not a guess\n *    about the text: `collectFields` fills a single entry from `detail` only for\n *    the flattened envelope a `tempest-fastapi-sdk` backend sends, where the\n *    server wrote one finished sentence about one field (`\"CPF ou CNPJ\n *    inválido\"`). Returning it shows the same string that is already on\n *    `fields`, so nothing is invented and nothing is lost. The assembled FastAPI\n *    line never reaches this branch, because it comes from the `detail` **list**\n *    and its entries are the per-issue messages, not `detail`.\n *\n *    This is a fix, not a preference. Before `namedField` shipped in 0.54.0,\n *    `fields` was empty against that backend and the sentence reached the user\n *    through step 3; filling `fields` silently replaced it with \"Confira os\n *    campos destacados\", which presumes a screen that highlights fields — and\n *    no app highlighted anything on the day of the bump.\n *\n *    `useDetail: false` still suppresses it, and is the way to force the fixed\n *    sentence for a backend whose text is written for developers. `validation`\n *    does **not** override it, and that is on purpose: its own contract is the\n *    sentence for a payload rejected *field by field*, which one field carrying\n *    one finished sentence is not — and `useDescribeApiError` always passes\n *    `validation`, so treating it as an override would mean the branch never ran\n *    for any component, which is every caller that matters here.\n * 3. The backend's own `detail`, which is the most specific thing available and\n *    is already written for a person — unless `useDetail: false` says that text\n *    is for developers.\n * 4. `fallback`, with `(HTTP <status>)` appended when a status is known, so the\n *    screenshot in the support ticket carries the one fact a developer needs.\n *\n * Pure on purpose: it works in an interceptor, in a logger and anywhere outside\n * the React tree. {@link useDescribeApiError} is the same funnel with the\n * sentences resolved through `I18nProvider`.\n *\n * @example\n * catch (error) {\n *     toast(describeApiError(error, \"Não foi possível salvar o pedido\"));\n * }\n *\n * @example\n * catch (error) {\n *     toast(\n *         describeApiError(error, \"Não foi possível se candidatar\", {\n *             codes: {\n *                 SERVICE_FULL: \"Este serviço atingiu o limite de vagas.\",\n *                 CANDIDATE_ALREADY_EXISTS: \"Você já se candidatou a este serviço.\",\n *             },\n *             useDetail: false,\n *         }),\n *     );\n * }\n *\n * @param error - The caught value, of any shape.\n * @param fallback - What to say when the error carries nothing better.\n * @param options - A `codes` catalog, `useDetail`, and overrides for the fixed\n *     sentences.\n * @returns A sentence to show the user.\n */\nexport function describeApiError(\n    error: unknown,\n    fallback: string,\n    options?: DescribeApiErrorOptions,\n): string {\n    const offline = options?.offline ?? DEFAULT_API_ERROR_STRINGS.offline;\n\n    if (isApiError(error)) {\n        const mapped = error.code === undefined ? undefined : options?.codes?.[error.code];\n        if (mapped !== undefined) return mapped;\n        const byStatus = options?.statuses?.[error.status];\n        if (byStatus !== undefined) return byStatus;\n        if (error.status === 0) return offline;\n        const detail = error.detail.trim();\n        if (error.fields && Object.keys(error.fields).length > 0) {\n            if (\n                options?.useDetail !== false &&\n                singleFieldSentence(error.fields, detail, error.status)\n            ) {\n                return detail;\n            }\n            return options?.validation ?? DEFAULT_API_ERROR_STRINGS.validation;\n        }\n        if (\n            options?.useDetail !== false &&\n            detail !== \"\" &&\n            detail !== syntheticDetail(error.status)\n        ) {\n            return detail;\n        }\n        return `${fallback} (HTTP ${error.status})`;\n    }\n\n    if (browserIsOffline()) return offline;\n\n    return fallback;\n}\n"],"mappings":"gCAgCA,IAAa,EAA6C,CACtD,QAAS,sEACT,WAAY,+CAChB,EAUa,EAAwB,wBAMxB,EAA2B,2BA8DxC,SAAS,GAA4B,CACjC,OAAO,OAAO,UAAc,KAAe,UAAU,SAAW,EACpE,CAkBA,SAAS,EACL,EACA,EACA,EACO,CACP,GAAI,IAAW,IAAM,IAAW,EAAA,gBAAgB,CAAM,EAAG,MAAO,GAChE,IAAM,EAAW,OAAO,OAAO,CAAM,EACrC,OAAO,EAAS,SAAW,GAAK,EAAS,EAAE,CAAC,KAAK,IAAM,CAC3D,CAoFA,SAAgB,EACZ,EACA,EACA,EACM,CACN,IAAM,EAAU,GAAS,SAAW,EAA0B,QAE9D,GAAI,EAAA,WAAW,CAAK,EAAG,CACnB,IAAM,EAAS,EAAM,OAAS,IAAA,GAAY,IAAA,GAAY,GAAS,QAAQ,EAAM,MAC7E,GAAI,IAAW,IAAA,GAAW,OAAO,EACjC,IAAM,EAAW,GAAS,WAAW,EAAM,QAC3C,GAAI,IAAa,IAAA,GAAW,OAAO,EACnC,GAAI,EAAM,SAAW,EAAG,OAAO,EAC/B,IAAM,EAAS,EAAM,OAAO,KAAK,EAiBjC,OAhBI,EAAM,QAAU,OAAO,KAAK,EAAM,MAAM,CAAC,CAAC,OAAS,EAE/C,GAAS,YAAc,IACvB,EAAoB,EAAM,OAAQ,EAAQ,EAAM,MAAM,EAE/C,EAEJ,GAAS,YAAc,EAA0B,WAGxD,GAAS,YAAc,IACvB,IAAW,IACX,IAAW,EAAA,gBAAgB,EAAM,MAAM,EAEhC,EAEJ,GAAG,EAAS,SAAS,EAAM,OAAO,EAC7C,CAIA,OAFI,EAAiB,EAAU,EAExB,CACX"}
+{"version":3,"file":"describe-api-error.cjs","names":["syntheticDetail","isApiError","require_errors","DEFAULT_API_ERROR_STRINGS","API_ERROR_OFFLINE_KEY","API_ERROR_VALIDATION_KEY","browserIsOffline","singleFieldSentence","detail","status","messages","fields","describeApiError","offline","options","error","mapped","byStatus","fallback"],"sources":["../../src/http/describe-api-error.ts"],"sourcesContent":["// The last mile of error handling: a typed error is what code reads, a sentence\n// is what a person reads, and every app was writing the funnel between the two.\n// The case everyone forgets is the request that never reached the server, which\n// without special handling renders as the nonsense \"erro 0\".\n\nimport { isApiError, syntheticDetail } from \"./errors\";\n\n/** The fixed sentences {@link describeApiError} may need. */\nexport interface ApiErrorStrings {\n    /** Shown when the request never reached the server. */\n    offline: string;\n    /**\n     * Shown when the backend rejected the payload field by field.\n     *\n     * The per-field messages are on `error.fields`, to be attached to the inputs\n     * themselves; this sentence is what the toast says.\n     *\n     * It does not apply to the one rejection that named a single field with a\n     * finished sentence — there the server's own `detail` is shown instead, since\n     * it is the same string `fields` carries. Pass `useDetail: false` to force\n     * this sentence in that case too.\n     */\n    validation: string;\n}\n\n/**\n * PT-BR defaults, used when no strings are supplied and no catalog answers.\n *\n * The SDK's copy is pt-BR everywhere else (`FilterBar`, `DataTable`, `Chat`), so\n * the default here matches rather than introducing an English string that only\n * shows up on a network failure.\n */\nexport const DEFAULT_API_ERROR_STRINGS: ApiErrorStrings = {\n    offline: \"Sem conexão com o servidor. Verifique sua internet e tente de novo.\",\n    validation: \"Confira os campos destacados e tente de novo.\",\n};\n\n/**\n * Translation key the {@link useDescribeApiError} hook looks up.\n *\n * A catalog that does not define it falls back to\n * {@link DEFAULT_API_ERROR_STRINGS}, because `t` returns the key itself when the\n * lookup misses and printing `tempest.error.offline` at the user would be worse\n * than printing pt-BR at them.\n */\nexport const API_ERROR_OFFLINE_KEY = \"tempest.error.offline\";\n\n/**\n * Translation key for the validation sentence, looked up the same way as\n * {@link API_ERROR_OFFLINE_KEY}.\n */\nexport const API_ERROR_VALIDATION_KEY = \"tempest.error.validation\";\n\n/**\n * Everything {@link describeApiError} accepts beyond the error and the fallback.\n *\n * Extends the fixed sentences rather than sitting beside them, so a caller that\n * already passed `{ offline, validation }` keeps compiling untouched.\n */\nexport interface DescribeApiErrorOptions extends Partial<ApiErrorStrings> {\n    /**\n     * Maps the backend's programmatic `code` to a sentence in your language.\n     *\n     * The client already surfaces `code` on `ApiError`, but without this every\n     * app writes the same `switch` over it. A hit here wins over every other\n     * step: it is the only sentence written for that exact case, by someone who\n     * knew both the backend contract and the screen it lands on.\n     */\n    codes?: Readonly<Record<string, string>>;\n    /**\n     * Maps an HTTP status to a sentence, for the failures that arrive with no\n     * useful body.\n     *\n     * `codes` covers the cases the backend named; this covers the ones it did\n     * not. The reference case is the `403` of an admin-only route: the body\n     * carries a generic `detail` (or none), so the funnel fell through to the\n     * fallback and an administrator read \"Não foi possível carregar\" when the\n     * fact that answers their question is \"esta listagem é só para\n     * administradores\".\n     *\n     * Checked after `codes` and **before** the backend's `detail`: a generic\n     * sentence emitted by the framework is worse than the one the app wrote for\n     * that status. `useDetail: false` remains the way to suppress `detail`\n     * entirely.\n     *\n     * A `0` key is honoured like any other, ahead of the offline sentence —\n     * `statuses` is the caller's explicit map, and the fixed `offline` string is\n     * already the way to reword that case. Status `0` covers a request that\n     * never landed **and** one abandoned by the client timeout, so an app that\n     * maps it is taking both.\n     */\n    statuses?: Readonly<Record<number, string>>;\n    /**\n     * Whether the backend's `detail` may be shown when no `code` matched.\n     * Default `true`.\n     *\n     * Set it to `false` when `detail` is written for developers rather than\n     * users, or when it could echo internals — the result is then always either\n     * a sentence you wrote or the fallback.\n     */\n    useDetail?: boolean;\n}\n\n/**\n * Whether the browser currently reports itself as offline.\n *\n * `fetch` rejects a network failure with a plain `TypeError` whose message\n * differs per browser (\"Failed to fetch\", \"NetworkError when attempting to fetch\n * resource.\", \"Load failed\"), so sniffing the message is not portable. The online\n * flag is, and it is the signal that matters for the sentence being chosen.\n *\n * @returns `true` only when the environment positively says it is offline.\n */\nfunction browserIsOffline(): boolean {\n    return typeof navigator !== \"undefined\" && navigator.onLine === false;\n}\n\n/**\n * Whether `fields` is the flattened single-field envelope, carrying `detail`.\n *\n * The check is identity rather than shape-sniffing. `collectFields` has exactly\n * two sources: FastAPI's `detail` **list**, whose entries are the per-issue\n * messages, and the flattened envelope, whose one entry is built from the same\n * string that becomes `ApiError.detail`. So one entry equal to `detail` can only\n * have come from the second, and returning `detail` there shows the string the\n * form is already about to attach to that input.\n *\n * @param fields - The error's field messages.\n * @param detail - `error.detail`, already trimmed.\n * @param status - The HTTP status, to recognise the synthetic `Erro <status>`\n *     that stands in when the body carried no message at all.\n * @returns Whether `detail` is safe to show as the sentence.\n */\nfunction singleFieldSentence(\n    fields: Record<string, string>,\n    detail: string,\n    status: number,\n): boolean {\n    if (detail === \"\" || detail === syntheticDetail(status)) return false;\n    const messages = Object.values(fields);\n    return messages.length === 1 && messages[0].trim() === detail;\n}\n\n/**\n * Turn any caught value into a sentence worth showing.\n *\n * The funnel, in order:\n *\n * 0. `codes[error.code]` — the sentence you wrote for that exact backend case.\n *    Checked first because nothing the funnel derives can beat it, and because a\n *    request that never landed carries no `code` for it to shadow.\n * 0.5. `statuses[error.status]` — the sentence for a whole class of failure,\n *    for the errors that arrive with no useful body. It beats the backend's\n *    `detail`, because a generic line emitted by the framework is worse than the\n *    one the app wrote for that status, and it beats the offline sentence when\n *    the caller maps `0` explicitly.\n * 1. A request that never reached the server — `status === 0`, or a non-API\n *    error thrown while the browser reports itself offline — produces the\n *    offline sentence. This is the step apps skip, and skipping it renders\n *    \"erro 0\" or a raw `TypeError` at the user.\n * 2. A validation rejection — `error.fields` is set — produces the validation\n *    sentence, **not** `detail`. On a FastAPI `422` the `detail` line is assembled\n *    from the backend's field paths and the validator's own wording\n *    (`\"items.0.price: Input should be greater than 0\"`), which is right for a\n *    log and wrong for a person: it is half English in a pt-BR screen and it\n *    names internals. The per-field messages stay on `fields`, where a form can\n *    attach them to the inputs that failed.\n *\n *    **Unless the rejection named exactly one field and its message is\n *    `detail` itself**, in which case `detail` is returned. That is not a guess\n *    about the text: `collectFields` fills a single entry from `detail` only for\n *    the flattened envelope a `tempest-fastapi-sdk` backend sends, where the\n *    server wrote one finished sentence about one field (`\"CPF ou CNPJ\n *    inválido\"`). Returning it shows the same string that is already on\n *    `fields`, so nothing is invented and nothing is lost. The assembled FastAPI\n *    line never reaches this branch, because it comes from the `detail` **list**\n *    and its entries are the per-issue messages, not `detail`.\n *\n *    This is a fix, not a preference. Before `namedField` shipped in 0.54.0,\n *    `fields` was empty against that backend and the sentence reached the user\n *    through step 3; filling `fields` silently replaced it with \"Confira os\n *    campos destacados\", which presumes a screen that highlights fields — and\n *    no app highlighted anything on the day of the bump.\n *\n *    `useDetail: false` still suppresses it, and is the way to force the fixed\n *    sentence for a backend whose text is written for developers. `validation`\n *    does **not** override it, and that is on purpose: its own contract is the\n *    sentence for a payload rejected *field by field*, which one field carrying\n *    one finished sentence is not — and `useDescribeApiError` always passes\n *    `validation`, so treating it as an override would mean the branch never ran\n *    for any component, which is every caller that matters here.\n * 3. The backend's own `detail`, which is the most specific thing available and\n *    is already written for a person — unless `useDetail: false` says that text\n *    is for developers.\n * 4. `fallback`, with `(HTTP <status>)` appended when a status is known, so the\n *    screenshot in the support ticket carries the one fact a developer needs.\n *\n * Pure on purpose: it works in an interceptor, in a logger and anywhere outside\n * the React tree. {@link useDescribeApiError} is the same funnel with the\n * sentences resolved through `I18nProvider`.\n *\n * @example\n * catch (error) {\n *     toast(describeApiError(error, \"Não foi possível salvar o pedido\"));\n * }\n *\n * @example\n * catch (error) {\n *     toast(\n *         describeApiError(error, \"Não foi possível se candidatar\", {\n *             codes: {\n *                 SERVICE_FULL: \"Este serviço atingiu o limite de vagas.\",\n *                 CANDIDATE_ALREADY_EXISTS: \"Você já se candidatou a este serviço.\",\n *             },\n *             useDetail: false,\n *         }),\n *     );\n * }\n *\n * @param error - The caught value, of any shape.\n * @param fallback - What to say when the error carries nothing better.\n * @param options - A `codes` catalog, `useDetail`, and overrides for the fixed\n *     sentences.\n * @returns A sentence to show the user.\n */\nexport function describeApiError(\n    error: unknown,\n    fallback: string,\n    options?: DescribeApiErrorOptions,\n): string {\n    const offline = options?.offline ?? DEFAULT_API_ERROR_STRINGS.offline;\n\n    if (isApiError(error)) {\n        const mapped = error.code === undefined ? undefined : options?.codes?.[error.code];\n        if (mapped !== undefined) return mapped;\n        const byStatus = options?.statuses?.[error.status];\n        if (byStatus !== undefined) return byStatus;\n        if (error.status === 0) return offline;\n        const detail = error.detail.trim();\n        if (error.fields && Object.keys(error.fields).length > 0) {\n            if (\n                options?.useDetail !== false &&\n                singleFieldSentence(error.fields, detail, error.status)\n            ) {\n                return detail;\n            }\n            return options?.validation ?? DEFAULT_API_ERROR_STRINGS.validation;\n        }\n        if (\n            options?.useDetail !== false &&\n            detail !== \"\" &&\n            detail !== syntheticDetail(error.status)\n        ) {\n            return detail;\n        }\n        return `${fallback} (HTTP ${error.status})`;\n    }\n\n    if (browserIsOffline()) return offline;\n\n    return fallback;\n}\n"],"mappings":"A,gCAgCA,IAAaG,EAA6C,CACtD,QAAS,sEACT,WAAY,+CAChB,EAUaC,EAAwB,wBAMxBC,EAA2B,2BA8DxC,SAASC,GAA4B,CACjC,OAAO,OAAO,UAAc,KAAe,UAAU,SAAW,EACpE,CAkBA,SAASC,EACL,EACA,EACA,EACO,CACP,GAAIC,IAAW,IAAMA,IAAWR,EAAAA,gBAAgBS,CAAM,EAAG,MAAO,GAChE,IAAMC,EAAW,OAAO,OAAOC,CAAM,EACrC,OAAOD,EAAS,SAAW,GAAKA,EAAS,EAAE,CAAC,KAAK,IAAMF,CAC3D,CAoFA,SAAgBI,EACZ,EACA,EACA,EACM,CACN,IAAMC,EAAUC,GAAS,SAAWX,EAA0B,QAE9D,GAAIF,EAAAA,WAAWc,CAAK,EAAG,CACnB,IAAMC,EAASD,EAAM,OAAS,IAAA,GAAY,IAAA,GAAYD,GAAS,QAAQC,EAAM,MAC7E,GAAIC,IAAW,IAAA,GAAW,OAAOA,EACjC,IAAMC,EAAWH,GAAS,WAAWC,EAAM,QAC3C,GAAIE,IAAa,IAAA,GAAW,OAAOA,EACnC,GAAIF,EAAM,SAAW,EAAG,OAAOF,EAC/B,IAAML,EAASO,EAAM,OAAO,KAAK,EAiBjC,OAhBIA,EAAM,QAAU,OAAO,KAAKA,EAAM,MAAM,CAAC,CAAC,OAAS,EAE/CD,GAAS,YAAc,IACvBP,EAAoBQ,EAAM,OAAQP,EAAQO,EAAM,MAAM,EAE/CP,EAEJM,GAAS,YAAcX,EAA0B,WAGxDW,GAAS,YAAc,IACvBN,IAAW,IACXA,IAAWR,EAAAA,gBAAgBe,EAAM,MAAM,EAEhCP,EAEJ,GAAGU,EAAS,SAASH,EAAM,OAAO,EAC7C,CAIA,OAFIT,EAAiB,EAAUO,EAExBK,CACX,C"}