tempest-react-sdk 0.79.0 → 0.81.0

package/dist/http/api-client.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.cjs","names":["TempestApiError","isRetriableStatus","buildApiError","isTrustedCredentialTarget","buildApiUrl","csrfHeaders","withTimeout","SessionSupersededError","randomId","retryWithBackoff","decodeByContentType","require_ids","require_build_url","require_credential_scope","require_csrf","require_decode_response","require_errors","require_retry","require_timeout","IDEMPOTENT_METHODS","isRetriableFailure","method","error","resolveRetry","config","DEFAULT_TIMEOUT","DEFAULT_UPLOAD_TIMEOUT","isFormData","body","elapsedMs","startedAt","parseError","response","sentRequestId","createApiClient","fetcher","authHeaders","skipAuth","token","url","rawRequest","rest","options","isForm","configured","limit","timeout","path","callerHeaders","headers","finalHeaders","requestId","timed","signal","init","cause","send","log","entry","line","notifyUnauthorized","context","authContext","attempt","sent","skipAuthRetry","replayed","decode","run","perRequest","retryOptions","request","upload","formData"],"sources":["../../src/http/api-client.ts"],"sourcesContent":["/**\n * @tempest-limits function-lines — createApiClient is over the limit and every line\n * is a request-lifecycle concern the client cannot delegate: base URL joining, the\n * auth header, the 401 refresh-and-replay, the opt-in retry wrapper and the response\n * parsing that turns a failure into a typed error.\n */\nimport { randomId } from \"../utils\";\nimport { buildApiUrl } from \"./build-url\";\nimport { isTrustedCredentialTarget, reportSuppressedCredential } from \"./credential-scope\";\nimport { csrfHeaders } from \"./csrf\";\nimport { decodeByContentType } from \"./decode-response\";\nimport type { ResponseDecoder } from \"./decode-response\";\nimport {\n    buildApiError,\n    SessionSupersededError,\n    TempestApiError,\n    isRetriableStatus,\n} from \"./errors\";\nimport { retry as retryWithBackoff } from \"./retry\";\nimport type { RetryOptions } from \"./retry\";\nimport { withTimeout } from \"./timeout\";\nimport type { ApiClient, ApiClientConfig, RequestAuthContext, RequestOptions } from \"./types\";\n\n/**\n * Methods the built-in retry policy will replay.\n *\n * `PUT` and `DELETE` are idempotent on paper but stay out: a backend that logs,\n * bills, or fires a webhook per call still sees two, so replaying them is a\n * decision the caller makes through `shouldRetry`, not a default.\n */\nconst IDEMPOTENT_METHODS: ReadonlySet<string> = new Set([\"GET\", \"HEAD\", \"OPTIONS\"]);\n\n/**\n * Sub-500 statuses worth a second attempt: a network failure (status `0`), a\n * request timeout, a too-early replay, and a rate limit — which usually carries\n * the `Retry-After` the backoff already honours.\n */\n\n/**\n * The built-in retry policy, used when `retry` is `true` or is options carrying\n * no `shouldRetry` of their own.\n *\n * Conservative on purpose. Replaying a write can duplicate it, and replaying a\n * `400` or a `403` cannot fix a bad payload or a permission the caller does not\n * have — it only spends the user's time before showing the same error.\n *\n * @param error - Whatever the attempt threw.\n * @param method - The upper-cased HTTP method of the request.\n * @returns Whether the client should try again.\n */\nfunction isRetriableFailure(error: unknown, method: string): boolean {\n    if (!IDEMPOTENT_METHODS.has(method)) return false;\n    if (!(error instanceof TempestApiError)) return false;\n    return isRetriableStatus(error.status);\n}\n\n/**\n * Normalize the `retry` config into options, or `null` when retrying is off.\n *\n * @param config - The `retry` field as the caller wrote it.\n * @returns Retry options to use, or `null` to run a single attempt.\n */\nfunction resolveRetry(config: boolean | RetryOptions | undefined): RetryOptions | null {\n    if (!config) return null;\n    return config === true ? {} : config;\n}\n\n/** Default milliseconds before a request is abandoned. */\nconst DEFAULT_TIMEOUT = 15_000;\n\n/** Default milliseconds before a `FormData` request is abandoned. */\nconst DEFAULT_UPLOAD_TIMEOUT = 300_000;\n\nfunction isFormData(body: unknown): body is FormData {\n    return typeof FormData !== \"undefined\" && body instanceof FormData;\n}\n\n/**\n * Milliseconds since a `performance.now()` reading, rounded.\n *\n * `performance.now()` rather than `Date.now()` because this measures a\n * duration: the wall clock can step sideways mid-request (an NTP correction, a\n * VM resuming, the user changing the clock) and turn a 40 ms call into a\n * negative number. The monotonic clock cannot.\n *\n * @param startedAt - The reading taken before the work started.\n * @returns Whole milliseconds elapsed.\n */\nfunction elapsedMs(startedAt: number): number {\n    return Math.round(performance.now() - startedAt);\n}\n\nasync function parseError(response: Response, sentRequestId?: string): Promise<TempestApiError> {\n    let body: unknown;\n    try {\n        body = await response.clone().json();\n    } catch {\n        try {\n            body = await response.text();\n        } catch {\n            body = null;\n        }\n    }\n    return new TempestApiError(\n        buildApiError(response.status, body, response.headers, sentRequestId),\n    );\n}\n\n/**\n * Create a typed HTTP client backed by `fetch`.\n *\n * Handles JSON serialization, query params, bearer auth via `getToken`, uploads\n * via `FormData`, and throws a typed `ApiError` on any non-2xx response.\n *\n * **Expired sessions.** A `401` with `refresh` configured awaits the refresh and\n * replays the request once. `onUnauthorized` fires whenever that path ends\n * unauthorized anyway — the refresh threw, or the replay came back `401` — which\n * is the signal to clear the session. Without `refresh`, the first `401` calls\n * it directly.\n *\n * **Binary bodies** have their own methods — `blob()` and `arrayBuffer()` — which\n * run the same pipeline and skip the parse. `request()` no longer decodes an\n * unknown `Content-Type` as text either: it returns a `Blob` and says so once in\n * a development build, because reading `image/jpeg` as UTF-8 destroyed the bytes\n * on the way in.\n *\n * **The bearer token is scoped to `baseURL`'s origin** since 0.66.0. A path may\n * be an absolute URL, which overrides the base entirely, so without a scope the\n * destination of a credentialed request could come from a value read off the\n * network. A request to another origin still goes out; it goes without the\n * header, and a development build says so once. Declare the exceptions in\n * {@link ApiClientConfig.trustedOrigins}.\n *\n * **CSRF** is off unless you set `csrf`. With it, every unsafe request (anything\n * but `GET`/`HEAD`/`OPTIONS`/`TRACE`) echoes the `csrf_token` cookie in an\n * `X-CSRF-Token` header — the double-submit contract of `tempest-fastapi-sdk`'s\n * `CSRFMiddleware` — scoped to the same origins as the bearer token and sent on\n * `skipAuth` requests too. See {@link ApiClientConfig.csrf}.\n *\n * **Retries** are off unless you set `retry`. See {@link ApiClientConfig.retry}\n * for the built-in policy; it never replays a write. A single call overrides it\n * with {@link RequestOptions.retry}, and opts out of auth entirely with\n * {@link RequestOptions.skipAuth}.\n *\n * **Logging** is off unless you pass a `logger`. With one, every finished attempt\n * writes a line — `debug` under 400, `warn` from 400 up, plus a `warn` when\n * `onUnauthorized` fires — carrying `requestId`, `status` and elapsed `ms`, and\n * never a body, header or query string. The level and the destination belong to\n * the logger, not to a boolean here.\n *\n * @example\n * const api = createApiClient({\n *     baseURL: import.meta.env.VITE_API_URL,\n *     getToken: () => useAuthStore.getState().token,\n *     refresh,\n *     onUnauthorized: () => useAuthStore.getState().logout(),\n *     logger: createLogger({ level: import.meta.env.DEV ? \"debug\" : \"warn\" }).child(\"http\"),\n *     retry: true,\n * });\n *\n * @param config - Base URL plus the optional auth, retry and fetch hooks.\n * @returns A client with `request`/`get`/`post`/`put`/`patch`/`delete`/`blob`/\n * `arrayBuffer`/`upload`.\n */\nexport function createApiClient(config: ApiClientConfig): ApiClient {\n    const fetcher = config.fetcher ?? globalThis.fetch.bind(globalThis);\n\n    /**\n     * The `Authorization` header for a request, or nothing.\n     *\n     * Takes the resolved URL rather than reading `config.baseURL`, because an\n     * absolute path overrides the base entirely (see `buildApiUrl`) and the\n     * credential is scoped to an origin, not to a client.\n     *\n     * @param url - The absolute URL the request is going to.\n     * @param skipAuth - Whether the caller opted this request out of auth.\n     * @returns The header, or an empty object.\n     */\n    function authHeaders(url: string, skipAuth: boolean): Record<string, string> {\n        if (skipAuth) return {};\n        const token = config.getToken?.();\n        if (!token) return {};\n        if (!isTrustedCredentialTarget(url, config.baseURL, config.trustedOrigins)) {\n            reportSuppressedCredential(url, config.baseURL);\n            return {};\n        }\n        return { Authorization: `Bearer ${token}` };\n    }\n\n    async function rawRequest(\n        path: string,\n        options: RequestOptions,\n        requestId: string | undefined,\n        skipAuth: boolean,\n    ): Promise<Response> {\n        const { body, params, headers, signal, timeout, ...rest } = options;\n        const isForm = isFormData(body);\n        const configured = isForm ? config.uploadTimeout : config.timeout;\n        const fallback = isForm ? DEFAULT_UPLOAD_TIMEOUT : DEFAULT_TIMEOUT;\n        const limit =\n            timeout !== undefined ? timeout : configured !== undefined ? configured : fallback;\n\n        const url = buildApiUrl(config.baseURL, path, { prefix: config.prefix, params });\n\n        const callerHeaders = headers as Record<string, string> | undefined;\n        const finalHeaders: Record<string, string> = {\n            ...(isForm ? {} : { \"Content-Type\": \"application/json\" }),\n            ...(requestId ? { \"X-Request-ID\": requestId } : {}),\n            ...config.headers,\n            ...authHeaders(url, skipAuth),\n            ...csrfHeaders({\n                method: rest.method ?? \"GET\",\n                url,\n                reference: config.baseURL,\n                csrf: config.csrf,\n                trustedOrigins: config.trustedOrigins,\n                headers: { ...config.headers, ...callerHeaders },\n            }),\n            ...callerHeaders,\n        };\n\n        const timed = withTimeout(signal, limit);\n        const init: RequestInit = {\n            ...rest,\n            signal: timed.signal,\n            headers: finalHeaders,\n            credentials: config.withCredentials ? \"include\" : rest.credentials,\n            body:\n                body === undefined || body === null\n                    ? undefined\n                    : isForm\n                      ? (body as FormData)\n                      : JSON.stringify(body),\n        };\n\n        try {\n            return await fetcher(url, init);\n        } catch (cause) {\n            if (timed.timedOut()) {\n                throw new TempestApiError({\n                    status: 0,\n                    detail: `A requisição excedeu ${limit}ms e foi abandonada.`,\n                });\n            }\n            throw cause;\n        } finally {\n            timed.dispose();\n        }\n    }\n\n    async function send(\n        path: string,\n        options: RequestOptions,\n        requestId: string,\n        method: string,\n        skipAuth: boolean,\n    ): Promise<Response> {\n        const log = config.logger;\n        if (!log) return rawRequest(path, options, requestId, skipAuth);\n\n        const startedAt = performance.now();\n        try {\n            const response = await rawRequest(path, options, requestId, skipAuth);\n            const entry = { requestId, status: response.status, ms: elapsedMs(startedAt) };\n            const line = `${method} ${path} → ${response.status}`;\n            if (response.status >= 400) log.warn(line, entry);\n            else log.debug(line, entry);\n            return response;\n        } catch (error) {\n            log.warn(`${method} ${path} → no response`, {\n                requestId,\n                ms: elapsedMs(startedAt),\n                error,\n            });\n            throw error;\n        }\n    }\n\n    /**\n     * Call `onUnauthorized`, keeping the request's own error unless the hook\n     * says the attempt belongs to an ended session.\n     *\n     * @param response - The `401` that ended the attempt.\n     * @param requestId - Correlation id for the log.\n     * @param context - The credential and session the attempt left with.\n     * @throws {SessionSupersededError} When `onUnauthorized` threw it.\n     */\n    async function notifyUnauthorized(\n        response: Response,\n        requestId: string,\n        context: RequestAuthContext,\n    ): Promise<void> {\n        if (!config.onUnauthorized) return;\n        config.logger?.warn(`unauthorized — calling onUnauthorized`, {\n            requestId,\n            status: response.status,\n        });\n        try {\n            await config.onUnauthorized(response, context);\n        } catch (error) {\n            if (error instanceof SessionSupersededError) throw error;\n            config.logger?.warn(`onUnauthorized threw — keeping the original response error`, {\n                requestId,\n                status: response.status,\n                error,\n            });\n        }\n    }\n\n    /**\n     * The credential and session an attempt leaves with, read just before it is\n     * sent.\n     *\n     * @param skipAuth - Whether the attempt goes out without credentials.\n     * @returns The context handed to `refresh` and `onUnauthorized`.\n     */\n    function authContext(skipAuth: boolean): RequestAuthContext {\n        return {\n            token: skipAuth ? null : (config.getToken?.() ?? null),\n            epoch: config.getSessionEpoch?.() ?? null,\n        };\n    }\n\n    async function attempt<T>(\n        path: string,\n        options: RequestOptions,\n        decode: ResponseDecoder<T>,\n    ): Promise<T> {\n        const { skipAuth = false, skipAuthRetry = false, ...init } = options;\n        const requestId = config.requestId ? config.requestId() : randomId();\n        const method = (init.method ?? \"GET\").toUpperCase();\n        const sent = authContext(skipAuth);\n        let response = await send(path, init, requestId, method, skipAuth);\n\n        if (response.status === 401 && !skipAuth && !skipAuthRetry) {\n            if (config.refresh) {\n                let replayed: RequestAuthContext;\n                try {\n                    await config.refresh(sent);\n                    replayed = authContext(skipAuth);\n                    response = await send(path, init, requestId, method, skipAuth);\n                } catch (error) {\n                    if (error instanceof SessionSupersededError) throw error;\n                    await notifyUnauthorized(response, requestId, sent);\n                    throw await parseError(response, requestId);\n                }\n                if (response.status === 401) {\n                    await notifyUnauthorized(response, requestId, replayed);\n                }\n            } else {\n                await notifyUnauthorized(response, requestId, sent);\n            }\n        }\n\n        if (!response.ok) {\n            throw await parseError(response, requestId);\n        }\n\n        return decode(response);\n    }\n\n    async function run<T>(\n        path: string,\n        options: RequestOptions,\n        decode: ResponseDecoder<T>,\n    ): Promise<T> {\n        const { retry: perRequest, ...rest } = options;\n        const retryOptions = resolveRetry(perRequest !== undefined ? perRequest : config.retry);\n        if (!retryOptions) return attempt<T>(path, rest, decode);\n\n        const method = (rest.method ?? \"GET\").toUpperCase();\n        return retryWithBackoff(() => attempt<T>(path, rest, decode), {\n            ...retryOptions,\n            shouldRetry:\n                retryOptions.shouldRetry ?? ((error: unknown) => isRetriableFailure(error, method)),\n        });\n    }\n\n    async function request<T>(path: string, options: RequestOptions = {}): Promise<T> {\n        return run<T>(path, options, decodeByContentType);\n    }\n\n    async function upload<T>(\n        path: string,\n        formData: FormData,\n        method: \"POST\" | \"PUT\" | \"PATCH\" = \"POST\",\n        options?: Omit<RequestOptions, \"body\" | \"method\">,\n    ): Promise<T> {\n        return request<T>(path, { ...options, method, body: formData });\n    }\n\n    return {\n        request,\n        get: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"GET\" }),\n        post: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"POST\" }),\n        put: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"PUT\" }),\n        patch: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"PATCH\" }),\n        delete: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"DELETE\" }),\n        blob: (path: string, options?: RequestOptions) =>\n            run<Blob>(path, { ...options }, (response) => response.blob()),\n        arrayBuffer: (path: string, options?: RequestOptions) =>\n            run<ArrayBuffer>(path, { ...options }, (response) => response.arrayBuffer()),\n        upload,\n    };\n}\n"],"mappings":"A,8OA8BA,IAAMmB,EAA0C,IAAI,IAAI,CAAC,MAAO,OAAQ,SAAS,CAAC,EAoBlF,SAASC,EAAmB,EAAgB,EAAyB,CAGjE,MAFI,CAACD,EAAmB,IAAIE,CAAM,GAC9B,EAAEC,aAAiBtB,EAAAA,iBAAyB,GACzCC,EAAAA,kBAAkBqB,EAAM,MAAM,CACzC,CAQA,SAASC,EAAa,EAAiE,CAEnF,OADKC,EACEA,IAAW,GAAO,CAAC,EAAIA,EADV,IAExB,CAGA,IAAMC,EAAkB,KAGlBC,EAAyB,IAE/B,SAASC,EAAW,EAAiC,CACjD,OAAO,OAAO,SAAa,KAAeC,aAAgB,QAC9D,CAaA,SAASC,EAAU,EAA2B,CAC1C,OAAO,KAAK,MAAM,YAAY,IAAI,EAAIC,CAAS,CACnD,CAEA,eAAeC,EAAW,EAAoB,EAAkD,CAC5F,IAAIH,EACJ,GAAI,CACA,EAAO,MAAMI,EAAS,MAAM,CAAC,CAAC,KAAK,CACvC,MAAQ,CACJ,GAAI,CACA,EAAO,MAAMA,EAAS,KAAK,CAC/B,MAAQ,CACJ,EAAO,IACX,CACJ,CACA,OAAO,IAAIhC,EAAAA,gBACPE,EAAAA,cAAc8B,EAAS,OAAQJ,EAAMI,EAAS,QAASC,CAAa,CACxE,CACJ,CA0DA,SAAgBC,EAAgB,EAAoC,CAChE,IAAMC,EAAUX,EAAO,SAAW,WAAW,MAAM,KAAK,UAAU,EAalE,SAASY,EAAY,EAAa,EAA2C,CACzE,GAAIC,EAAU,MAAO,CAAC,EACtB,IAAMC,EAAQd,EAAO,WAAW,EAMhC,OALKc,EACAnC,EAAAA,0BAA0BoC,EAAKf,EAAO,QAASA,EAAO,cAAc,EAIlE,CAAE,cAAe,UAAUc,GAAQ,GAHtCzB,EAAA,2BAA2B0B,EAAKf,EAAO,OAAO,EACvC,CAAC,GAHO,CAAC,CAMxB,CAEA,eAAegB,EACX,EACA,EACA,EACA,EACiB,CACjB,GAAM,CAAE,OAAM,SAAQ,UAAS,SAAQ,UAAS,GAAGC,GAASC,EACtDC,EAAShB,EAAWC,CAAI,EACxBgB,EAAaD,EAASnB,EAAO,cAAgBA,EAAO,QAEpDqB,EACFC,IAAY,IAAA,GAAsBF,IAAe,IAAA,GAFpCD,EAASjB,EAAyBD,EAEcmB,EAArCE,EAEtBP,EAAMnC,EAAAA,YAAYoB,EAAO,QAASuB,EAAM,CAAE,OAAQvB,EAAO,OAAQ,QAAO,CAAC,EAEzEwB,EAAgBC,EAChBC,EAAuC,CACzC,GAAIP,EAAS,CAAC,EAAI,CAAE,eAAgB,kBAAmB,EACvD,GAAIQ,EAAY,CAAE,eAAgBA,CAAU,EAAI,CAAC,EACjD,GAAG3B,EAAO,QACV,GAAGY,EAAYG,EAAKF,CAAQ,EAC5B,GAAGhC,EAAAA,YAAY,CACX,OAAQoC,EAAK,QAAU,MACvB,MACA,UAAWjB,EAAO,QAClB,KAAMA,EAAO,KACb,eAAgBA,EAAO,eACvB,QAAS,CAAE,GAAGA,EAAO,QAAS,GAAGwB,CAAc,CACnD,CAAC,EACD,GAAGA,CACP,EAEMI,EAAQ9C,EAAAA,YAAY+C,EAAQR,CAAK,EACjCS,EAAoB,CACtB,GAAGb,EACH,OAAQW,EAAM,OACd,QAASF,EACT,YAAa1B,EAAO,gBAAkB,UAAYiB,EAAK,YACvD,KACIb,GAA+B,KACzB,IAAA,GACAe,EACGf,EACD,KAAK,UAAUA,CAAI,CACnC,EAEA,GAAI,CACA,OAAO,MAAMO,EAAQI,EAAKe,CAAI,CAClC,OAASC,EAAO,CAOZ,MANIH,EAAM,SAAS,EACT,IAAIpD,EAAAA,gBAAgB,CACtB,OAAQ,EACR,OAAQ,wBAAwB6C,EAAM,qBAC1C,CAAC,EAECU,CACV,QAAU,CACNH,EAAM,QAAQ,CAClB,CACJ,CAEA,eAAeI,EACX,EACA,EACA,EACA,EACA,EACiB,CACjB,IAAMC,EAAMjC,EAAO,OACnB,GAAI,CAACiC,EAAK,OAAOjB,EAAWO,EAAML,EAASS,EAAWd,CAAQ,EAE9D,IAAMP,EAAY,YAAY,IAAI,EAClC,GAAI,CACA,IAAME,EAAW,MAAMQ,EAAWO,EAAML,EAASS,EAAWd,CAAQ,EAC9DqB,EAAQ,CAAE,YAAW,OAAQ1B,EAAS,OAAQ,GAAIH,EAAUC,CAAS,CAAE,EACvE6B,EAAO,GAAGtC,EAAO,GAAG0B,EAAK,KAAKf,EAAS,SAG7C,OAFIA,EAAS,QAAU,IAAKyB,EAAI,KAAKE,EAAMD,CAAK,EAC3CD,EAAI,MAAME,EAAMD,CAAK,EACnB1B,CACX,OAASV,EAAO,CAMZ,MALAmC,EAAI,KAAK,GAAGpC,EAAO,GAAG0B,EAAK,gBAAiB,CACxC,YACA,GAAIlB,EAAUC,CAAS,EACvB,OACJ,CAAC,EACKR,CACV,CACJ,CAWA,eAAesC,EACX,EACA,EACA,EACa,CACb,GAAKpC,EAAO,eACZ,GAAO,QAAQ,KAAK,wCAAyC,CACzD,YACA,OAAQQ,EAAS,MACrB,CAAC,EACD,GAAI,CACA,MAAMR,EAAO,eAAeQ,EAAU6B,CAAO,CACjD,OAASvC,EAAO,CACZ,GAAIA,aAAiBf,EAAAA,uBAAwB,MAAMe,EACnDE,EAAO,QAAQ,KAAK,6DAA8D,CAC9E,YACA,OAAQQ,EAAS,OACjB,OACJ,CAAC,CACL,CAVC,CAWL,CASA,SAAS8B,EAAY,EAAuC,CACxD,MAAO,CACH,MAAOzB,EAAW,KAAQb,EAAO,WAAW,GAAK,KACjD,MAAOA,EAAO,kBAAkB,GAAK,IACzC,CACJ,CAEA,eAAeuC,EACX,EACA,EACA,EACU,CACV,GAAM,CAAE,WAAW,GAAO,gBAAgB,GAAO,GAAGT,GAASZ,EACvDS,EAAY3B,EAAO,UAAYA,EAAO,UAAU,EAAIhB,EAAAA,SAAS,EAC7Da,GAAUiC,EAAK,QAAU,MAAA,CAAO,YAAY,EAC5CU,EAAOF,EAAYzB,CAAQ,EAC7BL,EAAW,MAAMwB,EAAKT,EAAMO,EAAMH,EAAW9B,EAAQgB,CAAQ,EAEjE,GAAIL,EAAS,SAAW,KAAO,CAACK,GAAY,CAAC4B,EAAe,CACxD,GAAIzC,EAAO,QAAS,CAChB,IAAI0C,EACJ,GAAI,CACA,MAAM1C,EAAO,QAAQwC,CAAI,EACzB,EAAWF,EAAYzB,CAAQ,EAC/B,EAAW,MAAMmB,EAAKT,EAAMO,EAAMH,EAAW9B,EAAQgB,CAAQ,CACjE,OAASf,EAAO,CAGZ,MAFIA,aAAiBf,EAAAA,uBAA8Be,GACnD,MAAMsC,EAAmB5B,EAAUmB,EAAWa,CAAI,EAC5C,MAAMjC,EAAWC,EAAUmB,CAAS,EAC9C,CACInB,EAAS,SAAW,KACpB,MAAM4B,EAAmB5B,EAAUmB,EAAWe,CAAQ,CAE9D,MACI,MAAMN,EAAmB5B,EAAUmB,EAAWa,CAAI,CAE1D,CAEA,GAAI,CAAChC,EAAS,GACV,MAAM,MAAMD,EAAWC,EAAUmB,CAAS,EAG9C,OAAOgB,EAAOnC,CAAQ,CAC1B,CAEA,eAAeoC,EACX,EACA,EACA,EACU,CACV,GAAM,CAAE,MAAOC,EAAY,GAAG5B,GAASC,EACjC4B,EAAe/C,EAAa8C,IAAe,IAAA,GAAyB7C,EAAO,MAApB6C,CAAyB,EACtF,GAAI,CAACC,EAAc,OAAOP,EAAWhB,EAAMN,EAAM0B,CAAM,EAEvD,IAAM9C,GAAUoB,EAAK,QAAU,MAAA,CAAO,YAAY,EAClD,OAAOhC,EAAAA,UAAuBsD,EAAWhB,EAAMN,EAAM0B,CAAM,EAAG,CAC1D,GAAGG,EACH,YACIA,EAAa,cAAiB,GAAmBlD,EAAmBE,EAAOD,CAAM,EACzF,CAAC,CACL,CAEA,eAAekD,EAAW,EAAc,EAA0B,CAAC,EAAe,CAC9E,OAAOH,EAAOrB,EAAML,EAAShC,EAAAA,mBAAmB,CACpD,CAEA,eAAe8D,EACX,EACA,EACA,EAAmC,OACnC,EACU,CACV,OAAOD,EAAWxB,EAAM,CAAE,GAAGL,EAAS,SAAQ,KAAM+B,CAAS,CAAC,CAClE,CAEA,MAAO,CACH,UACA,KAAS,EAAc,IACnBF,EAAWxB,EAAM,CAAE,GAAGL,EAAS,OAAQ,KAAM,CAAC,EAClD,MAAU,EAAc,IACpB6B,EAAWxB,EAAM,CAAE,GAAGL,EAAS,OAAQ,MAAO,CAAC,EACnD,KAAS,EAAc,IACnB6B,EAAWxB,EAAM,CAAE,GAAGL,EAAS,OAAQ,KAAM,CAAC,EAClD,OAAW,EAAc,IACrB6B,EAAWxB,EAAM,CAAE,GAAGL,EAAS,OAAQ,OAAQ,CAAC,EACpD,QAAY,EAAc,IACtB6B,EAAWxB,EAAM,CAAE,GAAGL,EAAS,OAAQ,QAAS,CAAC,EACrD,MAAO,EAAc,IACjB0B,EAAUrB,EAAM,CAAE,GAAGL,CAAQ,EAAI,GAAaV,EAAS,KAAK,CAAC,EACjE,aAAc,EAAc,IACxBoC,EAAiBrB,EAAM,CAAE,GAAGL,CAAQ,EAAI,GAAaV,EAAS,YAAY,CAAC,EAC/E,QACJ,CACJ,C"}
+{"version":3,"file":"api-client.cjs","names":["TempestApiError","isRetriableStatus","buildApiError","isTrustedCredentialTarget","buildApiUrl","csrfHeaders","withTimeout","SessionSupersededError","randomId","retryWithBackoff","decodeByContentType","require_errors","require_ids","require_build_url","require_credential_scope","require_csrf","require_decode_response","require_retry","require_timeout","IDEMPOTENT_METHODS","isRetriableFailure","method","error","resolveRetry","config","DEFAULT_TIMEOUT","DEFAULT_UPLOAD_TIMEOUT","isFormData","body","elapsedMs","startedAt","pathForLog","path","parseError","response","sentRequestId","createApiClient","fetcher","authHeaders","skipAuth","token","url","rawRequest","rest","options","isForm","configured","limit","timeout","callerHeaders","headers","finalHeaders","requestId","timed","signal","init","cause","send","log","target","entry","line","notifyUnauthorized","context","authContext","attempt","sent","skipAuthRetry","replayed","decode","run","perRequest","retryOptions","request","upload","formData"],"sources":["../../src/http/api-client.ts"],"sourcesContent":["/**\n * @tempest-limits function-lines — createApiClient is over the limit and every line\n * is a request-lifecycle concern the client cannot delegate: base URL joining, the\n * auth header, the 401 refresh-and-replay, the opt-in retry wrapper and the response\n * parsing that turns a failure into a typed error.\n */\nimport { randomId } from \"../utils\";\nimport { buildApiUrl } from \"./build-url\";\nimport { isTrustedCredentialTarget, reportSuppressedCredential } from \"./credential-scope\";\nimport { csrfHeaders } from \"./csrf\";\nimport { decodeByContentType } from \"./decode-response\";\nimport type { ResponseDecoder } from \"./decode-response\";\nimport {\n    buildApiError,\n    SessionSupersededError,\n    TempestApiError,\n    isRetriableStatus,\n} from \"./errors\";\nimport { retry as retryWithBackoff } from \"./retry\";\nimport type { RetryOptions } from \"./retry\";\nimport { withTimeout } from \"./timeout\";\nimport type { ApiClient, ApiClientConfig, RequestAuthContext, RequestOptions } from \"./types\";\n\n/**\n * Methods the built-in retry policy will replay.\n *\n * `PUT` and `DELETE` are idempotent on paper but stay out: a backend that logs,\n * bills, or fires a webhook per call still sees two, so replaying them is a\n * decision the caller makes through `shouldRetry`, not a default.\n */\nconst IDEMPOTENT_METHODS: ReadonlySet<string> = new Set([\"GET\", \"HEAD\", \"OPTIONS\"]);\n\n/**\n * Sub-500 statuses worth a second attempt: a network failure (status `0`), a\n * request timeout, a too-early replay, and a rate limit — which usually carries\n * the `Retry-After` the backoff already honours.\n */\n\n/**\n * The built-in retry policy, used when `retry` is `true` or is options carrying\n * no `shouldRetry` of their own.\n *\n * Conservative on purpose. Replaying a write can duplicate it, and replaying a\n * `400` or a `403` cannot fix a bad payload or a permission the caller does not\n * have — it only spends the user's time before showing the same error.\n *\n * @param error - Whatever the attempt threw.\n * @param method - The upper-cased HTTP method of the request.\n * @returns Whether the client should try again.\n */\nfunction isRetriableFailure(error: unknown, method: string): boolean {\n    if (!IDEMPOTENT_METHODS.has(method)) return false;\n    if (!(error instanceof TempestApiError)) return false;\n    return isRetriableStatus(error.status);\n}\n\n/**\n * Normalize the `retry` config into options, or `null` when retrying is off.\n *\n * @param config - The `retry` field as the caller wrote it.\n * @returns Retry options to use, or `null` to run a single attempt.\n */\nfunction resolveRetry(config: boolean | RetryOptions | undefined): RetryOptions | null {\n    if (!config) return null;\n    return config === true ? {} : config;\n}\n\n/** Default milliseconds before a request is abandoned. */\nconst DEFAULT_TIMEOUT = 15_000;\n\n/** Default milliseconds before a `FormData` request is abandoned. */\nconst DEFAULT_UPLOAD_TIMEOUT = 300_000;\n\nfunction isFormData(body: unknown): body is FormData {\n    return typeof FormData !== \"undefined\" && body instanceof FormData;\n}\n\n/**\n * Milliseconds since a `performance.now()` reading, rounded.\n *\n * `performance.now()` rather than `Date.now()` because this measures a\n * duration: the wall clock can step sideways mid-request (an NTP correction, a\n * VM resuming, the user changing the clock) and turn a 40 ms call into a\n * negative number. The monotonic clock cannot.\n *\n * @param startedAt - The reading taken before the work started.\n * @returns Whole milliseconds elapsed.\n */\nfunction elapsedMs(startedAt: number): number {\n    return Math.round(performance.now() - startedAt);\n}\n\n/**\n * The request path as the log line shows it: no query, no fragment, no userinfo.\n *\n * The logger promises never to write the query string, and `params` was never\n * the only way one gets in: a call site can write `\"/files?access_token=…\"`\n * inline, and an absolute path — the signed upload endpoint or CDN URL that\n * `buildApiUrl` passes through untouched — carries its signature in the query\n * and may carry `user:password@` in the authority. Everything from the first\n * `?` or `#` is dropped and the userinfo of an absolute (or scheme-relative)\n * URL is removed; the host and the path stay, because they are what makes the\n * line useful. Pure string work, no `URL` round trip, so a path that would not\n * parse is still logged instead of throwing inside the logging branch.\n *\n * @param path - The path exactly as the call site passed it.\n * @returns The path without query, fragment or credentials.\n */\nfunction pathForLog(path: string): string {\n    return path.replace(/[?#][^]*/, \"\").replace(/^([^/]*\\/\\/)[^/]*@/, \"$1\");\n}\n\nasync function parseError(response: Response, sentRequestId?: string): Promise<TempestApiError> {\n    let body: unknown;\n    try {\n        body = await response.clone().json();\n    } catch {\n        try {\n            body = await response.text();\n        } catch {\n            body = null;\n        }\n    }\n    return new TempestApiError(\n        buildApiError(response.status, body, response.headers, sentRequestId),\n    );\n}\n\n/**\n * Create a typed HTTP client backed by `fetch`.\n *\n * Handles JSON serialization, query params, bearer auth via `getToken`, uploads\n * via `FormData`, and throws a typed `ApiError` on any non-2xx response.\n *\n * **Expired sessions.** A `401` with `refresh` configured awaits the refresh and\n * replays the request once. `onUnauthorized` fires whenever that path ends\n * unauthorized anyway — the refresh threw, or the replay came back `401` — which\n * is the signal to clear the session. Without `refresh`, the first `401` calls\n * it directly.\n *\n * **Binary bodies** have their own methods — `blob()` and `arrayBuffer()` — which\n * run the same pipeline and skip the parse. `request()` no longer decodes an\n * unknown `Content-Type` as text either: it returns a `Blob` and says so once in\n * a development build, because reading `image/jpeg` as UTF-8 destroyed the bytes\n * on the way in.\n *\n * **The bearer token is scoped to `baseURL`'s origin** since 0.66.0. A path may\n * be an absolute URL, which overrides the base entirely, so without a scope the\n * destination of a credentialed request could come from a value read off the\n * network. A request to another origin still goes out; it goes without the\n * header, and a development build says so once. Declare the exceptions in\n * {@link ApiClientConfig.trustedOrigins}.\n *\n * **CSRF** is off unless you set `csrf`. With it, every unsafe request (anything\n * but `GET`/`HEAD`/`OPTIONS`/`TRACE`) echoes the `csrf_token` cookie in an\n * `X-CSRF-Token` header — the double-submit contract of `tempest-fastapi-sdk`'s\n * `CSRFMiddleware` — scoped to the same origins as the bearer token and sent on\n * `skipAuth` requests too. See {@link ApiClientConfig.csrf}.\n *\n * **Retries** are off unless you set `retry`. See {@link ApiClientConfig.retry}\n * for the built-in policy; it never replays a write. A single call overrides it\n * with {@link RequestOptions.retry}, and opts out of auth entirely with\n * {@link RequestOptions.skipAuth}.\n *\n * **Logging** is off unless you pass a `logger`. With one, every finished attempt\n * writes a line — `debug` under 400, `warn` from 400 up, plus a `warn` when\n * `onUnauthorized` fires — carrying `requestId`, `status` and elapsed `ms`, and\n * never a body, header or query string. The level and the destination belong to\n * the logger, not to a boolean here.\n *\n * @example\n * const api = createApiClient({\n *     baseURL: import.meta.env.VITE_API_URL,\n *     getToken: () => useAuthStore.getState().token,\n *     refresh,\n *     onUnauthorized: () => useAuthStore.getState().logout(),\n *     logger: createLogger({ level: import.meta.env.DEV ? \"debug\" : \"warn\" }).child(\"http\"),\n *     retry: true,\n * });\n *\n * @param config - Base URL plus the optional auth, retry and fetch hooks.\n * @returns A client with `request`/`get`/`post`/`put`/`patch`/`delete`/`blob`/\n * `arrayBuffer`/`upload`.\n */\nexport function createApiClient(config: ApiClientConfig): ApiClient {\n    const fetcher = config.fetcher ?? globalThis.fetch.bind(globalThis);\n\n    /**\n     * The `Authorization` header for a request, or nothing.\n     *\n     * Takes the resolved URL rather than reading `config.baseURL`, because an\n     * absolute path overrides the base entirely (see `buildApiUrl`) and the\n     * credential is scoped to an origin, not to a client.\n     *\n     * @param url - The absolute URL the request is going to.\n     * @param skipAuth - Whether the caller opted this request out of auth.\n     * @returns The header, or an empty object.\n     */\n    function authHeaders(url: string, skipAuth: boolean): Record<string, string> {\n        if (skipAuth) return {};\n        const token = config.getToken?.();\n        if (!token) return {};\n        if (!isTrustedCredentialTarget(url, config.baseURL, config.trustedOrigins)) {\n            reportSuppressedCredential(url, config.baseURL);\n            return {};\n        }\n        return { Authorization: `Bearer ${token}` };\n    }\n\n    async function rawRequest(\n        path: string,\n        options: RequestOptions,\n        requestId: string | undefined,\n        skipAuth: boolean,\n    ): Promise<Response> {\n        const { body, params, headers, signal, timeout, ...rest } = options;\n        const isForm = isFormData(body);\n        const configured = isForm ? config.uploadTimeout : config.timeout;\n        const fallback = isForm ? DEFAULT_UPLOAD_TIMEOUT : DEFAULT_TIMEOUT;\n        const limit =\n            timeout !== undefined ? timeout : configured !== undefined ? configured : fallback;\n\n        const url = buildApiUrl(config.baseURL, path, { prefix: config.prefix, params });\n\n        const callerHeaders = headers as Record<string, string> | undefined;\n        const finalHeaders: Record<string, string> = {\n            ...(isForm ? {} : { \"Content-Type\": \"application/json\" }),\n            ...(requestId ? { \"X-Request-ID\": requestId } : {}),\n            ...config.headers,\n            ...authHeaders(url, skipAuth),\n            ...csrfHeaders({\n                method: rest.method ?? \"GET\",\n                url,\n                reference: config.baseURL,\n                csrf: config.csrf,\n                trustedOrigins: config.trustedOrigins,\n                headers: { ...config.headers, ...callerHeaders },\n            }),\n            ...callerHeaders,\n        };\n\n        const timed = withTimeout(signal, limit);\n        const init: RequestInit = {\n            ...rest,\n            signal: timed.signal,\n            headers: finalHeaders,\n            credentials: config.withCredentials ? \"include\" : rest.credentials,\n            body:\n                body === undefined || body === null\n                    ? undefined\n                    : isForm\n                      ? (body as FormData)\n                      : JSON.stringify(body),\n        };\n\n        try {\n            return await fetcher(url, init);\n        } catch (cause) {\n            if (timed.timedOut()) {\n                throw new TempestApiError({\n                    status: 0,\n                    detail: `A requisição excedeu ${limit}ms e foi abandonada.`,\n                });\n            }\n            throw cause;\n        } finally {\n            timed.dispose();\n        }\n    }\n\n    async function send(\n        path: string,\n        options: RequestOptions,\n        requestId: string,\n        method: string,\n        skipAuth: boolean,\n    ): Promise<Response> {\n        const log = config.logger;\n        if (!log) return rawRequest(path, options, requestId, skipAuth);\n\n        const target = `${method} ${pathForLog(path)}`;\n        const startedAt = performance.now();\n        try {\n            const response = await rawRequest(path, options, requestId, skipAuth);\n            const entry = { requestId, status: response.status, ms: elapsedMs(startedAt) };\n            const line = `${target} → ${response.status}`;\n            if (response.status >= 400) log.warn(line, entry);\n            else log.debug(line, entry);\n            return response;\n        } catch (error) {\n            log.warn(`${target} → no response`, {\n                requestId,\n                ms: elapsedMs(startedAt),\n                error,\n            });\n            throw error;\n        }\n    }\n\n    /**\n     * Call `onUnauthorized`, keeping the request's own error unless the hook\n     * says the attempt belongs to an ended session.\n     *\n     * @param response - The `401` that ended the attempt.\n     * @param requestId - Correlation id for the log.\n     * @param context - The credential and session the attempt left with.\n     * @throws {SessionSupersededError} When `onUnauthorized` threw it.\n     */\n    async function notifyUnauthorized(\n        response: Response,\n        requestId: string,\n        context: RequestAuthContext,\n    ): Promise<void> {\n        if (!config.onUnauthorized) return;\n        config.logger?.warn(`unauthorized — calling onUnauthorized`, {\n            requestId,\n            status: response.status,\n        });\n        try {\n            await config.onUnauthorized(response, context);\n        } catch (error) {\n            if (error instanceof SessionSupersededError) throw error;\n            config.logger?.warn(`onUnauthorized threw — keeping the original response error`, {\n                requestId,\n                status: response.status,\n                error,\n            });\n        }\n    }\n\n    /**\n     * The credential and session an attempt leaves with, read just before it is\n     * sent.\n     *\n     * @param skipAuth - Whether the attempt goes out without credentials.\n     * @returns The context handed to `refresh` and `onUnauthorized`.\n     */\n    function authContext(skipAuth: boolean): RequestAuthContext {\n        return {\n            token: skipAuth ? null : (config.getToken?.() ?? null),\n            epoch: config.getSessionEpoch?.() ?? null,\n        };\n    }\n\n    async function attempt<T>(\n        path: string,\n        options: RequestOptions,\n        decode: ResponseDecoder<T>,\n    ): Promise<T> {\n        const { skipAuth = false, skipAuthRetry = false, ...init } = options;\n        const requestId = config.requestId ? config.requestId() : randomId();\n        const method = (init.method ?? \"GET\").toUpperCase();\n        const sent = authContext(skipAuth);\n        let response = await send(path, init, requestId, method, skipAuth);\n\n        if (response.status === 401 && !skipAuth && !skipAuthRetry) {\n            if (config.refresh) {\n                let replayed: RequestAuthContext;\n                try {\n                    await config.refresh(sent);\n                    replayed = authContext(skipAuth);\n                    response = await send(path, init, requestId, method, skipAuth);\n                } catch (error) {\n                    if (error instanceof SessionSupersededError) throw error;\n                    await notifyUnauthorized(response, requestId, sent);\n                    throw await parseError(response, requestId);\n                }\n                if (response.status === 401) {\n                    await notifyUnauthorized(response, requestId, replayed);\n                }\n            } else {\n                await notifyUnauthorized(response, requestId, sent);\n            }\n        }\n\n        if (!response.ok) {\n            throw await parseError(response, requestId);\n        }\n\n        return decode(response);\n    }\n\n    async function run<T>(\n        path: string,\n        options: RequestOptions,\n        decode: ResponseDecoder<T>,\n    ): Promise<T> {\n        const { retry: perRequest, ...rest } = options;\n        const retryOptions = resolveRetry(perRequest !== undefined ? perRequest : config.retry);\n        if (!retryOptions) return attempt<T>(path, rest, decode);\n\n        const method = (rest.method ?? \"GET\").toUpperCase();\n        return retryWithBackoff(() => attempt<T>(path, rest, decode), {\n            ...retryOptions,\n            shouldRetry:\n                retryOptions.shouldRetry ?? ((error: unknown) => isRetriableFailure(error, method)),\n        });\n    }\n\n    async function request<T>(path: string, options: RequestOptions = {}): Promise<T> {\n        return run<T>(path, options, decodeByContentType);\n    }\n\n    async function upload<T>(\n        path: string,\n        formData: FormData,\n        method: \"POST\" | \"PUT\" | \"PATCH\" = \"POST\",\n        options?: Omit<RequestOptions, \"body\" | \"method\">,\n    ): Promise<T> {\n        return request<T>(path, { ...options, method, body: formData });\n    }\n\n    return {\n        request,\n        get: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"GET\" }),\n        post: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"POST\" }),\n        put: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"PUT\" }),\n        patch: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"PATCH\" }),\n        delete: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"DELETE\" }),\n        blob: (path: string, options?: RequestOptions) =>\n            run<Blob>(path, { ...options }, (response) => response.blob()),\n        arrayBuffer: (path: string, options?: RequestOptions) =>\n            run<ArrayBuffer>(path, { ...options }, (response) => response.arrayBuffer()),\n        upload,\n        url: (path: string, params?: RequestOptions[\"params\"]) =>\n            buildApiUrl(config.baseURL, path, { prefix: config.prefix, params }),\n    };\n}\n"],"mappings":"A,8OA8BA,IAAMmB,EAA0C,IAAI,IAAI,CAAC,MAAO,OAAQ,SAAS,CAAC,EAoBlF,SAASC,EAAmB,EAAgB,EAAyB,CAGjE,MAFI,CAACD,EAAmB,IAAIE,CAAM,GAC9B,EAAEC,aAAiBtB,EAAAA,iBAAyB,GACzCC,EAAAA,kBAAkBqB,EAAM,MAAM,CACzC,CAQA,SAASC,EAAa,EAAiE,CAEnF,OADKC,EACEA,IAAW,GAAO,CAAC,EAAIA,EADV,IAExB,CAGA,IAAMC,EAAkB,KAGlBC,EAAyB,IAE/B,SAASC,EAAW,EAAiC,CACjD,OAAO,OAAO,SAAa,KAAeC,aAAgB,QAC9D,CAaA,SAASC,EAAU,EAA2B,CAC1C,OAAO,KAAK,MAAM,YAAY,IAAI,EAAIC,CAAS,CACnD,CAkBA,SAASC,EAAW,EAAsB,CACtC,OAAOC,EAAK,QAAQ,WAAY,EAAE,CAAC,CAAC,QAAQ,qBAAsB,IAAI,CAC1E,CAEA,eAAeC,EAAW,EAAoB,EAAkD,CAC5F,IAAIL,EACJ,GAAI,CACA,EAAO,MAAMM,EAAS,MAAM,CAAC,CAAC,KAAK,CACvC,MAAQ,CACJ,GAAI,CACA,EAAO,MAAMA,EAAS,KAAK,CAC/B,MAAQ,CACJ,EAAO,IACX,CACJ,CACA,OAAO,IAAIlC,EAAAA,gBACPE,EAAAA,cAAcgC,EAAS,OAAQN,EAAMM,EAAS,QAASC,CAAa,CACxE,CACJ,CA0DA,SAAgBC,EAAgB,EAAoC,CAChE,IAAMC,EAAUb,EAAO,SAAW,WAAW,MAAM,KAAK,UAAU,EAalE,SAASc,EAAY,EAAa,EAA2C,CACzE,GAAIC,EAAU,MAAO,CAAC,EACtB,IAAMC,EAAQhB,EAAO,WAAW,EAMhC,OALKgB,EACArC,EAAAA,0BAA0BsC,EAAKjB,EAAO,QAASA,EAAO,cAAc,EAIlE,CAAE,cAAe,UAAUgB,GAAQ,GAHtC1B,EAAA,2BAA2B2B,EAAKjB,EAAO,OAAO,EACvC,CAAC,GAHO,CAAC,CAMxB,CAEA,eAAekB,EACX,EACA,EACA,EACA,EACiB,CACjB,GAAM,CAAE,OAAM,SAAQ,UAAS,SAAQ,UAAS,GAAGC,GAASC,EACtDC,EAASlB,EAAWC,CAAI,EACxBkB,EAAaD,EAASrB,EAAO,cAAgBA,EAAO,QAEpDuB,EACFC,IAAY,IAAA,GAAsBF,IAAe,IAAA,GAFpCD,EAASnB,EAAyBD,EAEcqB,EAArCE,EAEtBP,EAAMrC,EAAAA,YAAYoB,EAAO,QAASQ,EAAM,CAAE,OAAQR,EAAO,OAAQ,QAAO,CAAC,EAEzEyB,EAAgBC,EAChBC,EAAuC,CACzC,GAAIN,EAAS,CAAC,EAAI,CAAE,eAAgB,kBAAmB,EACvD,GAAIO,EAAY,CAAE,eAAgBA,CAAU,EAAI,CAAC,EACjD,GAAG5B,EAAO,QACV,GAAGc,EAAYG,EAAKF,CAAQ,EAC5B,GAAGlC,EAAAA,YAAY,CACX,OAAQsC,EAAK,QAAU,MACvB,MACA,UAAWnB,EAAO,QAClB,KAAMA,EAAO,KACb,eAAgBA,EAAO,eACvB,QAAS,CAAE,GAAGA,EAAO,QAAS,GAAGyB,CAAc,CACnD,CAAC,EACD,GAAGA,CACP,EAEMI,EAAQ/C,EAAAA,YAAYgD,EAAQP,CAAK,EACjCQ,EAAoB,CACtB,GAAGZ,EACH,OAAQU,EAAM,OACd,QAASF,EACT,YAAa3B,EAAO,gBAAkB,UAAYmB,EAAK,YACvD,KACIf,GAA+B,KACzB,IAAA,GACAiB,EACGjB,EACD,KAAK,UAAUA,CAAI,CACnC,EAEA,GAAI,CACA,OAAO,MAAMS,EAAQI,EAAKc,CAAI,CAClC,OAASC,EAAO,CAOZ,MANIH,EAAM,SAAS,EACT,IAAIrD,EAAAA,gBAAgB,CACtB,OAAQ,EACR,OAAQ,wBAAwB+C,EAAM,qBAC1C,CAAC,EAECS,CACV,QAAU,CACNH,EAAM,QAAQ,CAClB,CACJ,CAEA,eAAeI,EACX,EACA,EACA,EACA,EACA,EACiB,CACjB,IAAMC,EAAMlC,EAAO,OACnB,GAAI,CAACkC,EAAK,OAAOhB,EAAWV,EAAMY,EAASQ,EAAWb,CAAQ,EAE9D,IAAMoB,EAAS,GAAGtC,EAAO,GAAGU,EAAWC,CAAI,IACrCF,EAAY,YAAY,IAAI,EAClC,GAAI,CACA,IAAMI,EAAW,MAAMQ,EAAWV,EAAMY,EAASQ,EAAWb,CAAQ,EAC9DqB,EAAQ,CAAE,YAAW,OAAQ1B,EAAS,OAAQ,GAAIL,EAAUC,CAAS,CAAE,EACvE+B,EAAO,GAAGF,EAAO,KAAKzB,EAAS,SAGrC,OAFIA,EAAS,QAAU,IAAKwB,EAAI,KAAKG,EAAMD,CAAK,EAC3CF,EAAI,MAAMG,EAAMD,CAAK,EACnB1B,CACX,OAASZ,EAAO,CAMZ,MALAoC,EAAI,KAAK,GAAGC,EAAO,gBAAiB,CAChC,YACA,GAAI9B,EAAUC,CAAS,EACvB,OACJ,CAAC,EACKR,CACV,CACJ,CAWA,eAAewC,EACX,EACA,EACA,EACa,CACb,GAAKtC,EAAO,eACZ,GAAO,QAAQ,KAAK,wCAAyC,CACzD,YACA,OAAQU,EAAS,MACrB,CAAC,EACD,GAAI,CACA,MAAMV,EAAO,eAAeU,EAAU6B,CAAO,CACjD,OAASzC,EAAO,CACZ,GAAIA,aAAiBf,EAAAA,uBAAwB,MAAMe,EACnDE,EAAO,QAAQ,KAAK,6DAA8D,CAC9E,YACA,OAAQU,EAAS,OACjB,OACJ,CAAC,CACL,CAVC,CAWL,CASA,SAAS8B,EAAY,EAAuC,CACxD,MAAO,CACH,MAAOzB,EAAW,KAAQf,EAAO,WAAW,GAAK,KACjD,MAAOA,EAAO,kBAAkB,GAAK,IACzC,CACJ,CAEA,eAAeyC,EACX,EACA,EACA,EACU,CACV,GAAM,CAAE,WAAW,GAAO,gBAAgB,GAAO,GAAGV,GAASX,EACvDQ,EAAY5B,EAAO,UAAYA,EAAO,UAAU,EAAIhB,EAAAA,SAAS,EAC7Da,GAAUkC,EAAK,QAAU,MAAA,CAAO,YAAY,EAC5CW,EAAOF,EAAYzB,CAAQ,EAC7BL,EAAW,MAAMuB,EAAKzB,EAAMuB,EAAMH,EAAW/B,EAAQkB,CAAQ,EAEjE,GAAIL,EAAS,SAAW,KAAO,CAACK,GAAY,CAAC4B,EAAe,CACxD,GAAI3C,EAAO,QAAS,CAChB,IAAI4C,EACJ,GAAI,CACA,MAAM5C,EAAO,QAAQ0C,CAAI,EACzB,EAAWF,EAAYzB,CAAQ,EAC/B,EAAW,MAAMkB,EAAKzB,EAAMuB,EAAMH,EAAW/B,EAAQkB,CAAQ,CACjE,OAASjB,EAAO,CAGZ,MAFIA,aAAiBf,EAAAA,uBAA8Be,GACnD,MAAMwC,EAAmB5B,EAAUkB,EAAWc,CAAI,EAC5C,MAAMjC,EAAWC,EAAUkB,CAAS,EAC9C,CACIlB,EAAS,SAAW,KACpB,MAAM4B,EAAmB5B,EAAUkB,EAAWgB,CAAQ,CAE9D,MACI,MAAMN,EAAmB5B,EAAUkB,EAAWc,CAAI,CAE1D,CAEA,GAAI,CAAChC,EAAS,GACV,MAAM,MAAMD,EAAWC,EAAUkB,CAAS,EAG9C,OAAOiB,EAAOnC,CAAQ,CAC1B,CAEA,eAAeoC,EACX,EACA,EACA,EACU,CACV,GAAM,CAAE,MAAOC,EAAY,GAAG5B,GAASC,EACjC4B,EAAejD,EAAagD,IAAe,IAAA,GAAyB/C,EAAO,MAApB+C,CAAyB,EACtF,GAAI,CAACC,EAAc,OAAOP,EAAWjC,EAAMW,EAAM0B,CAAM,EAEvD,IAAMhD,GAAUsB,EAAK,QAAU,MAAA,CAAO,YAAY,EAClD,OAAOlC,EAAAA,UAAuBwD,EAAWjC,EAAMW,EAAM0B,CAAM,EAAG,CAC1D,GAAGG,EACH,YACIA,EAAa,cAAiB,GAAmBpD,EAAmBE,EAAOD,CAAM,EACzF,CAAC,CACL,CAEA,eAAeoD,EAAW,EAAc,EAA0B,CAAC,EAAe,CAC9E,OAAOH,EAAOtC,EAAMY,EAASlC,EAAAA,mBAAmB,CACpD,CAEA,eAAegE,EACX,EACA,EACA,EAAmC,OACnC,EACU,CACV,OAAOD,EAAWzC,EAAM,CAAE,GAAGY,EAAS,SAAQ,KAAM+B,CAAS,CAAC,CAClE,CAEA,MAAO,CACH,UACA,KAAS,EAAc,IACnBF,EAAWzC,EAAM,CAAE,GAAGY,EAAS,OAAQ,KAAM,CAAC,EAClD,MAAU,EAAc,IACpB6B,EAAWzC,EAAM,CAAE,GAAGY,EAAS,OAAQ,MAAO,CAAC,EACnD,KAAS,EAAc,IACnB6B,EAAWzC,EAAM,CAAE,GAAGY,EAAS,OAAQ,KAAM,CAAC,EAClD,OAAW,EAAc,IACrB6B,EAAWzC,EAAM,CAAE,GAAGY,EAAS,OAAQ,OAAQ,CAAC,EACpD,QAAY,EAAc,IACtB6B,EAAWzC,EAAM,CAAE,GAAGY,EAAS,OAAQ,QAAS,CAAC,EACrD,MAAO,EAAc,IACjB0B,EAAUtC,EAAM,CAAE,GAAGY,CAAQ,EAAI,GAAaV,EAAS,KAAK,CAAC,EACjE,aAAc,EAAc,IACxBoC,EAAiBtC,EAAM,CAAE,GAAGY,CAAQ,EAAI,GAAaV,EAAS,YAAY,CAAC,EAC/E,SACA,KAAM,EAAc,IAChB9B,EAAAA,YAAYoB,EAAO,QAASQ,EAAM,CAAE,OAAQR,EAAO,OAAQ,QAAO,CAAC,CAC3E,CACJ,C"}

package/dist/http/api-client.js

@@ -1,9 +1,9 @@
-import { randomId as e } from "../utils/ids.js";
-import { buildApiUrl as t } from "./build-url.js";
-import { isTrustedCredentialTarget as n, reportSuppressedCredential as r } from "./credential-scope.js";
-import { csrfHeaders as i } from "./csrf.js";
-import { decodeByContentType as a } from "./decode-response.js";
-import { SessionSupersededError as o, TempestApiError as s, buildApiError as c, isRetriableStatus as l } from "./errors.js";
+import { SessionSupersededError as e, TempestApiError as t, buildApiError as n, isRetriableStatus as r } from "./errors.js";
+import { randomId as i } from "../utils/ids.js";
+import { buildApiUrl as a } from "./build-url.js";
+import { isTrustedCredentialTarget as o, reportSuppressedCredential as s } from "./credential-scope.js";
+import { csrfHeaders as c } from "./csrf.js";
+import { decodeByContentType as l } from "./decode-response.js";
 import { retry as u } from "./retry.js";
 import { withTimeout as d } from "./timeout.js";
 //#region src/http/api-client.ts
@@ -12,8 +12,8 @@ var f = /* @__PURE__ */ new Set([
 	"HEAD",
 	"OPTIONS"
 ]);
-function p(e, t) {
-	return !f.has(t) || !(e instanceof s) ? !1 : l(e.status);
+function p(e, n) {
+	return !f.has(n) || !(e instanceof t) ? !1 : r(e.status);
 }
 function m(e) {
 	return e ? e === !0 ? {} : e : null;
@@ -25,43 +25,46 @@ function _(e) {
 function v(e) {
 	return Math.round(performance.now() - e);
 }
-async function y(e, t) {
-	let n;
+function y(e) {
+	return e.replace(/[?#][^]*/, "").replace(/^([^/]*\/\/)[^/]*@/, "$1");
+}
+async function b(e, r) {
+	let i;
 	try {
-		n = await e.clone().json();
+		i = await e.clone().json();
 	} catch {
 		try {
-			n = await e.text();
+			i = await e.text();
 		} catch {
-			n = null;
+			i = null;
 		}
 	}
-	return new s(c(e.status, n, e.headers, t));
+	return new t(n(e.status, i, e.headers, r));
 }
-function b(c) {
-	let l = c.fetcher ?? globalThis.fetch.bind(globalThis);
+function x(n) {
+	let r = n.fetcher ?? globalThis.fetch.bind(globalThis);
 	function f(e, t) {
 		if (t) return {};
-		let i = c.getToken?.();
-		return i ? n(e, c.baseURL, c.trustedOrigins) ? { Authorization: `Bearer ${i}` } : (r(e, c.baseURL), {}) : {};
+		let r = n.getToken?.();
+		return r ? o(e, n.baseURL, n.trustedOrigins) ? { Authorization: `Bearer ${r}` } : (s(e, n.baseURL), {}) : {};
 	}
-	async function b(e, n, r, a) {
-		let { body: o, params: u, headers: p, signal: m, timeout: v, ...y } = n, b = _(o), x = b ? c.uploadTimeout : c.timeout, S = v === void 0 ? x === void 0 ? b ? g : h : x : v, C = t(c.baseURL, e, {
-			prefix: c.prefix,
+	async function x(e, i, o, s) {
+		let { body: l, params: u, headers: p, signal: m, timeout: v, ...y } = i, b = _(l), x = b ? n.uploadTimeout : n.timeout, S = v === void 0 ? x === void 0 ? b ? g : h : x : v, C = a(n.baseURL, e, {
+			prefix: n.prefix,
 			params: u
 		}), w = p, T = {
 			...b ? {} : { "Content-Type": "application/json" },
-			...r ? { "X-Request-ID": r } : {},
-			...c.headers,
-			...f(C, a),
-			...i({
+			...o ? { "X-Request-ID": o } : {},
+			...n.headers,
+			...f(C, s),
+			...c({
 				method: y.method ?? "GET",
 				url: C,
-				reference: c.baseURL,
-				csrf: c.csrf,
-				trustedOrigins: c.trustedOrigins,
+				reference: n.baseURL,
+				csrf: n.csrf,
+				trustedOrigins: n.trustedOrigins,
 				headers: {
-					...c.headers,
+					...n.headers,
 					...w
 				}
 			}),
@@ -70,13 +73,13 @@ function b(c) {
 			...y,
 			signal: E.signal,
 			headers: T,
-			credentials: c.withCredentials ? "include" : y.credentials,
-			body: o == null ? void 0 : b ? o : JSON.stringify(o)
+			credentials: n.withCredentials ? "include" : y.credentials,
+			body: l == null ? void 0 : b ? l : JSON.stringify(l)
 		};
 		try {
-			return await l(C, D);
+			return await r(C, D);
 		} catch (e) {
-			throw E.timedOut() ? new s({
+			throw E.timedOut() ? new t({
 				status: 0,
 				detail: `A requisição excedeu ${S}ms e foi abandonada.`
 			}) : e;
@@ -84,112 +87,116 @@ function b(c) {
 			E.dispose();
 		}
 	}
-	async function x(e, t, n, r, i) {
-		let a = c.logger;
-		if (!a) return b(e, t, n, i);
-		let o = performance.now();
+	async function S(e, t, r, i, a) {
+		let o = n.logger;
+		if (!o) return x(e, t, r, a);
+		let s = `${i} ${y(e)}`, c = performance.now();
 		try {
-			let s = await b(e, t, n, i), c = {
-				requestId: n,
-				status: s.status,
-				ms: v(o)
-			}, l = `${r} ${e} → ${s.status}`;
-			return s.status >= 400 ? a.warn(l, c) : a.debug(l, c), s;
-		} catch (t) {
-			throw a.warn(`${r} ${e} → no response`, {
-				requestId: n,
-				ms: v(o),
-				error: t
-			}), t;
+			let n = await x(e, t, r, a), i = {
+				requestId: r,
+				status: n.status,
+				ms: v(c)
+			}, l = `${s} → ${n.status}`;
+			return n.status >= 400 ? o.warn(l, i) : o.debug(l, i), n;
+		} catch (e) {
+			throw o.warn(`${s} → no response`, {
+				requestId: r,
+				ms: v(c),
+				error: e
+			}), e;
 		}
 	}
-	async function S(e, t, n) {
-		if (c.onUnauthorized) {
-			c.logger?.warn("unauthorized — calling onUnauthorized", {
-				requestId: t,
-				status: e.status
+	async function C(t, r, i) {
+		if (n.onUnauthorized) {
+			n.logger?.warn("unauthorized — calling onUnauthorized", {
+				requestId: r,
+				status: t.status
 			});
 			try {
-				await c.onUnauthorized(e, n);
-			} catch (n) {
-				if (n instanceof o) throw n;
-				c.logger?.warn("onUnauthorized threw — keeping the original response error", {
-					requestId: t,
-					status: e.status,
-					error: n
+				await n.onUnauthorized(t, i);
+			} catch (i) {
+				if (i instanceof e) throw i;
+				n.logger?.warn("onUnauthorized threw — keeping the original response error", {
+					requestId: r,
+					status: t.status,
+					error: i
 				});
 			}
 		}
 	}
-	function C(e) {
+	function w(e) {
 		return {
-			token: e ? null : c.getToken?.() ?? null,
-			epoch: c.getSessionEpoch?.() ?? null
+			token: e ? null : n.getToken?.() ?? null,
+			epoch: n.getSessionEpoch?.() ?? null
 		};
 	}
-	async function w(t, n, r) {
-		let { skipAuth: i = !1, skipAuthRetry: a = !1, ...s } = n, l = c.requestId ? c.requestId() : e(), u = (s.method ?? "GET").toUpperCase(), d = C(i), f = await x(t, s, l, u, i);
-		if (f.status === 401 && !i && !a) {
-			if (c.refresh) {
-				let e;
+	async function T(t, r, a) {
+		let { skipAuth: o = !1, skipAuthRetry: s = !1, ...c } = r, l = n.requestId ? n.requestId() : i(), u = (c.method ?? "GET").toUpperCase(), d = w(o), f = await S(t, c, l, u, o);
+		if (f.status === 401 && !o && !s) {
+			if (n.refresh) {
+				let r;
 				try {
-					await c.refresh(d), e = C(i), f = await x(t, s, l, u, i);
-				} catch (e) {
-					throw e instanceof o ? e : (await S(f, l, d), await y(f, l));
+					await n.refresh(d), r = w(o), f = await S(t, c, l, u, o);
+				} catch (t) {
+					throw t instanceof e ? t : (await C(f, l, d), await b(f, l));
 				}
-				f.status === 401 && await S(f, l, e);
-			} else await S(f, l, d);
+				f.status === 401 && await C(f, l, r);
+			} else await C(f, l, d);
 		}
-		if (!f.ok) throw await y(f, l);
-		return r(f);
+		if (!f.ok) throw await b(f, l);
+		return a(f);
 	}
-	async function T(e, t, n) {
-		let { retry: r, ...i } = t, a = m(r === void 0 ? c.retry : r);
-		if (!a) return w(e, i, n);
-		let o = (i.method ?? "GET").toUpperCase();
-		return u(() => w(e, i, n), {
-			...a,
-			shouldRetry: a.shouldRetry ?? ((e) => p(e, o))
+	async function E(e, t, r) {
+		let { retry: i, ...a } = t, o = m(i === void 0 ? n.retry : i);
+		if (!o) return T(e, a, r);
+		let s = (a.method ?? "GET").toUpperCase();
+		return u(() => T(e, a, r), {
+			...o,
+			shouldRetry: o.shouldRetry ?? ((e) => p(e, s))
 		});
 	}
-	async function E(e, t = {}) {
-		return T(e, t, a);
+	async function D(e, t = {}) {
+		return E(e, t, l);
 	}
-	async function D(e, t, n = "POST", r) {
-		return E(e, {
+	async function O(e, t, n = "POST", r) {
+		return D(e, {
 			...r,
 			method: n,
 			body: t
 		});
 	}
 	return {
-		request: E,
-		get: (e, t) => E(e, {
+		request: D,
+		get: (e, t) => D(e, {
 			...t,
 			method: "GET"
 		}),
-		post: (e, t) => E(e, {
+		post: (e, t) => D(e, {
 			...t,
 			method: "POST"
 		}),
-		put: (e, t) => E(e, {
+		put: (e, t) => D(e, {
 			...t,
 			method: "PUT"
 		}),
-		patch: (e, t) => E(e, {
+		patch: (e, t) => D(e, {
 			...t,
 			method: "PATCH"
 		}),
-		delete: (e, t) => E(e, {
+		delete: (e, t) => D(e, {
 			...t,
 			method: "DELETE"
 		}),
-		blob: (e, t) => T(e, { ...t }, (e) => e.blob()),
-		arrayBuffer: (e, t) => T(e, { ...t }, (e) => e.arrayBuffer()),
-		upload: D
+		blob: (e, t) => E(e, { ...t }, (e) => e.blob()),
+		arrayBuffer: (e, t) => E(e, { ...t }, (e) => e.arrayBuffer()),
+		upload: O,
+		url: (e, t) => a(n.baseURL, e, {
+			prefix: n.prefix,
+			params: t
+		})
 	};
 }
 //#endregion
-export { b as createApiClient };
+export { x as createApiClient };
 
 //# sourceMappingURL=api-client.js.map

package/dist/http/api-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.js","names":["retryWithBackoff","IDEMPOTENT_METHODS","isRetriableFailure","method","error","TempestApiError","isRetriableStatus","resolveRetry","config","DEFAULT_TIMEOUT","DEFAULT_UPLOAD_TIMEOUT","isFormData","body","elapsedMs","startedAt","parseError","response","buildApiError","sentRequestId","createApiClient","fetcher","authHeaders","skipAuth","token","isTrustedCredentialTarget","url","reportSuppressedCredential","rawRequest","rest","options","isForm","configured","limit","timeout","buildApiUrl","path","callerHeaders","headers","finalHeaders","requestId","csrfHeaders","timed","withTimeout","signal","init","cause","send","log","entry","line","notifyUnauthorized","context","SessionSupersededError","authContext","attempt","randomId","sent","skipAuthRetry","replayed","decode","run","perRequest","retryOptions","retry","request","decodeByContentType","upload","formData"],"sources":["../../src/http/api-client.ts"],"sourcesContent":["/**\n * @tempest-limits function-lines — createApiClient is over the limit and every line\n * is a request-lifecycle concern the client cannot delegate: base URL joining, the\n * auth header, the 401 refresh-and-replay, the opt-in retry wrapper and the response\n * parsing that turns a failure into a typed error.\n */\nimport { randomId } from \"../utils\";\nimport { buildApiUrl } from \"./build-url\";\nimport { isTrustedCredentialTarget, reportSuppressedCredential } from \"./credential-scope\";\nimport { csrfHeaders } from \"./csrf\";\nimport { decodeByContentType } from \"./decode-response\";\nimport type { ResponseDecoder } from \"./decode-response\";\nimport {\n    buildApiError,\n    SessionSupersededError,\n    TempestApiError,\n    isRetriableStatus,\n} from \"./errors\";\nimport { retry as retryWithBackoff } from \"./retry\";\nimport type { RetryOptions } from \"./retry\";\nimport { withTimeout } from \"./timeout\";\nimport type { ApiClient, ApiClientConfig, RequestAuthContext, RequestOptions } from \"./types\";\n\n/**\n * Methods the built-in retry policy will replay.\n *\n * `PUT` and `DELETE` are idempotent on paper but stay out: a backend that logs,\n * bills, or fires a webhook per call still sees two, so replaying them is a\n * decision the caller makes through `shouldRetry`, not a default.\n */\nconst IDEMPOTENT_METHODS: ReadonlySet<string> = new Set([\"GET\", \"HEAD\", \"OPTIONS\"]);\n\n/**\n * Sub-500 statuses worth a second attempt: a network failure (status `0`), a\n * request timeout, a too-early replay, and a rate limit — which usually carries\n * the `Retry-After` the backoff already honours.\n */\n\n/**\n * The built-in retry policy, used when `retry` is `true` or is options carrying\n * no `shouldRetry` of their own.\n *\n * Conservative on purpose. Replaying a write can duplicate it, and replaying a\n * `400` or a `403` cannot fix a bad payload or a permission the caller does not\n * have — it only spends the user's time before showing the same error.\n *\n * @param error - Whatever the attempt threw.\n * @param method - The upper-cased HTTP method of the request.\n * @returns Whether the client should try again.\n */\nfunction isRetriableFailure(error: unknown, method: string): boolean {\n    if (!IDEMPOTENT_METHODS.has(method)) return false;\n    if (!(error instanceof TempestApiError)) return false;\n    return isRetriableStatus(error.status);\n}\n\n/**\n * Normalize the `retry` config into options, or `null` when retrying is off.\n *\n * @param config - The `retry` field as the caller wrote it.\n * @returns Retry options to use, or `null` to run a single attempt.\n */\nfunction resolveRetry(config: boolean | RetryOptions | undefined): RetryOptions | null {\n    if (!config) return null;\n    return config === true ? {} : config;\n}\n\n/** Default milliseconds before a request is abandoned. */\nconst DEFAULT_TIMEOUT = 15_000;\n\n/** Default milliseconds before a `FormData` request is abandoned. */\nconst DEFAULT_UPLOAD_TIMEOUT = 300_000;\n\nfunction isFormData(body: unknown): body is FormData {\n    return typeof FormData !== \"undefined\" && body instanceof FormData;\n}\n\n/**\n * Milliseconds since a `performance.now()` reading, rounded.\n *\n * `performance.now()` rather than `Date.now()` because this measures a\n * duration: the wall clock can step sideways mid-request (an NTP correction, a\n * VM resuming, the user changing the clock) and turn a 40 ms call into a\n * negative number. The monotonic clock cannot.\n *\n * @param startedAt - The reading taken before the work started.\n * @returns Whole milliseconds elapsed.\n */\nfunction elapsedMs(startedAt: number): number {\n    return Math.round(performance.now() - startedAt);\n}\n\nasync function parseError(response: Response, sentRequestId?: string): Promise<TempestApiError> {\n    let body: unknown;\n    try {\n        body = await response.clone().json();\n    } catch {\n        try {\n            body = await response.text();\n        } catch {\n            body = null;\n        }\n    }\n    return new TempestApiError(\n        buildApiError(response.status, body, response.headers, sentRequestId),\n    );\n}\n\n/**\n * Create a typed HTTP client backed by `fetch`.\n *\n * Handles JSON serialization, query params, bearer auth via `getToken`, uploads\n * via `FormData`, and throws a typed `ApiError` on any non-2xx response.\n *\n * **Expired sessions.** A `401` with `refresh` configured awaits the refresh and\n * replays the request once. `onUnauthorized` fires whenever that path ends\n * unauthorized anyway — the refresh threw, or the replay came back `401` — which\n * is the signal to clear the session. Without `refresh`, the first `401` calls\n * it directly.\n *\n * **Binary bodies** have their own methods — `blob()` and `arrayBuffer()` — which\n * run the same pipeline and skip the parse. `request()` no longer decodes an\n * unknown `Content-Type` as text either: it returns a `Blob` and says so once in\n * a development build, because reading `image/jpeg` as UTF-8 destroyed the bytes\n * on the way in.\n *\n * **The bearer token is scoped to `baseURL`'s origin** since 0.66.0. A path may\n * be an absolute URL, which overrides the base entirely, so without a scope the\n * destination of a credentialed request could come from a value read off the\n * network. A request to another origin still goes out; it goes without the\n * header, and a development build says so once. Declare the exceptions in\n * {@link ApiClientConfig.trustedOrigins}.\n *\n * **CSRF** is off unless you set `csrf`. With it, every unsafe request (anything\n * but `GET`/`HEAD`/`OPTIONS`/`TRACE`) echoes the `csrf_token` cookie in an\n * `X-CSRF-Token` header — the double-submit contract of `tempest-fastapi-sdk`'s\n * `CSRFMiddleware` — scoped to the same origins as the bearer token and sent on\n * `skipAuth` requests too. See {@link ApiClientConfig.csrf}.\n *\n * **Retries** are off unless you set `retry`. See {@link ApiClientConfig.retry}\n * for the built-in policy; it never replays a write. A single call overrides it\n * with {@link RequestOptions.retry}, and opts out of auth entirely with\n * {@link RequestOptions.skipAuth}.\n *\n * **Logging** is off unless you pass a `logger`. With one, every finished attempt\n * writes a line — `debug` under 400, `warn` from 400 up, plus a `warn` when\n * `onUnauthorized` fires — carrying `requestId`, `status` and elapsed `ms`, and\n * never a body, header or query string. The level and the destination belong to\n * the logger, not to a boolean here.\n *\n * @example\n * const api = createApiClient({\n *     baseURL: import.meta.env.VITE_API_URL,\n *     getToken: () => useAuthStore.getState().token,\n *     refresh,\n *     onUnauthorized: () => useAuthStore.getState().logout(),\n *     logger: createLogger({ level: import.meta.env.DEV ? \"debug\" : \"warn\" }).child(\"http\"),\n *     retry: true,\n * });\n *\n * @param config - Base URL plus the optional auth, retry and fetch hooks.\n * @returns A client with `request`/`get`/`post`/`put`/`patch`/`delete`/`blob`/\n * `arrayBuffer`/`upload`.\n */\nexport function createApiClient(config: ApiClientConfig): ApiClient {\n    const fetcher = config.fetcher ?? globalThis.fetch.bind(globalThis);\n\n    /**\n     * The `Authorization` header for a request, or nothing.\n     *\n     * Takes the resolved URL rather than reading `config.baseURL`, because an\n     * absolute path overrides the base entirely (see `buildApiUrl`) and the\n     * credential is scoped to an origin, not to a client.\n     *\n     * @param url - The absolute URL the request is going to.\n     * @param skipAuth - Whether the caller opted this request out of auth.\n     * @returns The header, or an empty object.\n     */\n    function authHeaders(url: string, skipAuth: boolean): Record<string, string> {\n        if (skipAuth) return {};\n        const token = config.getToken?.();\n        if (!token) return {};\n        if (!isTrustedCredentialTarget(url, config.baseURL, config.trustedOrigins)) {\n            reportSuppressedCredential(url, config.baseURL);\n            return {};\n        }\n        return { Authorization: `Bearer ${token}` };\n    }\n\n    async function rawRequest(\n        path: string,\n        options: RequestOptions,\n        requestId: string | undefined,\n        skipAuth: boolean,\n    ): Promise<Response> {\n        const { body, params, headers, signal, timeout, ...rest } = options;\n        const isForm = isFormData(body);\n        const configured = isForm ? config.uploadTimeout : config.timeout;\n        const fallback = isForm ? DEFAULT_UPLOAD_TIMEOUT : DEFAULT_TIMEOUT;\n        const limit =\n            timeout !== undefined ? timeout : configured !== undefined ? configured : fallback;\n\n        const url = buildApiUrl(config.baseURL, path, { prefix: config.prefix, params });\n\n        const callerHeaders = headers as Record<string, string> | undefined;\n        const finalHeaders: Record<string, string> = {\n            ...(isForm ? {} : { \"Content-Type\": \"application/json\" }),\n            ...(requestId ? { \"X-Request-ID\": requestId } : {}),\n            ...config.headers,\n            ...authHeaders(url, skipAuth),\n            ...csrfHeaders({\n                method: rest.method ?? \"GET\",\n                url,\n                reference: config.baseURL,\n                csrf: config.csrf,\n                trustedOrigins: config.trustedOrigins,\n                headers: { ...config.headers, ...callerHeaders },\n            }),\n            ...callerHeaders,\n        };\n\n        const timed = withTimeout(signal, limit);\n        const init: RequestInit = {\n            ...rest,\n            signal: timed.signal,\n            headers: finalHeaders,\n            credentials: config.withCredentials ? \"include\" : rest.credentials,\n            body:\n                body === undefined || body === null\n                    ? undefined\n                    : isForm\n                      ? (body as FormData)\n                      : JSON.stringify(body),\n        };\n\n        try {\n            return await fetcher(url, init);\n        } catch (cause) {\n            if (timed.timedOut()) {\n                throw new TempestApiError({\n                    status: 0,\n                    detail: `A requisição excedeu ${limit}ms e foi abandonada.`,\n                });\n            }\n            throw cause;\n        } finally {\n            timed.dispose();\n        }\n    }\n\n    async function send(\n        path: string,\n        options: RequestOptions,\n        requestId: string,\n        method: string,\n        skipAuth: boolean,\n    ): Promise<Response> {\n        const log = config.logger;\n        if (!log) return rawRequest(path, options, requestId, skipAuth);\n\n        const startedAt = performance.now();\n        try {\n            const response = await rawRequest(path, options, requestId, skipAuth);\n            const entry = { requestId, status: response.status, ms: elapsedMs(startedAt) };\n            const line = `${method} ${path} → ${response.status}`;\n            if (response.status >= 400) log.warn(line, entry);\n            else log.debug(line, entry);\n            return response;\n        } catch (error) {\n            log.warn(`${method} ${path} → no response`, {\n                requestId,\n                ms: elapsedMs(startedAt),\n                error,\n            });\n            throw error;\n        }\n    }\n\n    /**\n     * Call `onUnauthorized`, keeping the request's own error unless the hook\n     * says the attempt belongs to an ended session.\n     *\n     * @param response - The `401` that ended the attempt.\n     * @param requestId - Correlation id for the log.\n     * @param context - The credential and session the attempt left with.\n     * @throws {SessionSupersededError} When `onUnauthorized` threw it.\n     */\n    async function notifyUnauthorized(\n        response: Response,\n        requestId: string,\n        context: RequestAuthContext,\n    ): Promise<void> {\n        if (!config.onUnauthorized) return;\n        config.logger?.warn(`unauthorized — calling onUnauthorized`, {\n            requestId,\n            status: response.status,\n        });\n        try {\n            await config.onUnauthorized(response, context);\n        } catch (error) {\n            if (error instanceof SessionSupersededError) throw error;\n            config.logger?.warn(`onUnauthorized threw — keeping the original response error`, {\n                requestId,\n                status: response.status,\n                error,\n            });\n        }\n    }\n\n    /**\n     * The credential and session an attempt leaves with, read just before it is\n     * sent.\n     *\n     * @param skipAuth - Whether the attempt goes out without credentials.\n     * @returns The context handed to `refresh` and `onUnauthorized`.\n     */\n    function authContext(skipAuth: boolean): RequestAuthContext {\n        return {\n            token: skipAuth ? null : (config.getToken?.() ?? null),\n            epoch: config.getSessionEpoch?.() ?? null,\n        };\n    }\n\n    async function attempt<T>(\n        path: string,\n        options: RequestOptions,\n        decode: ResponseDecoder<T>,\n    ): Promise<T> {\n        const { skipAuth = false, skipAuthRetry = false, ...init } = options;\n        const requestId = config.requestId ? config.requestId() : randomId();\n        const method = (init.method ?? \"GET\").toUpperCase();\n        const sent = authContext(skipAuth);\n        let response = await send(path, init, requestId, method, skipAuth);\n\n        if (response.status === 401 && !skipAuth && !skipAuthRetry) {\n            if (config.refresh) {\n                let replayed: RequestAuthContext;\n                try {\n                    await config.refresh(sent);\n                    replayed = authContext(skipAuth);\n                    response = await send(path, init, requestId, method, skipAuth);\n                } catch (error) {\n                    if (error instanceof SessionSupersededError) throw error;\n                    await notifyUnauthorized(response, requestId, sent);\n                    throw await parseError(response, requestId);\n                }\n                if (response.status === 401) {\n                    await notifyUnauthorized(response, requestId, replayed);\n                }\n            } else {\n                await notifyUnauthorized(response, requestId, sent);\n            }\n        }\n\n        if (!response.ok) {\n            throw await parseError(response, requestId);\n        }\n\n        return decode(response);\n    }\n\n    async function run<T>(\n        path: string,\n        options: RequestOptions,\n        decode: ResponseDecoder<T>,\n    ): Promise<T> {\n        const { retry: perRequest, ...rest } = options;\n        const retryOptions = resolveRetry(perRequest !== undefined ? perRequest : config.retry);\n        if (!retryOptions) return attempt<T>(path, rest, decode);\n\n        const method = (rest.method ?? \"GET\").toUpperCase();\n        return retryWithBackoff(() => attempt<T>(path, rest, decode), {\n            ...retryOptions,\n            shouldRetry:\n                retryOptions.shouldRetry ?? ((error: unknown) => isRetriableFailure(error, method)),\n        });\n    }\n\n    async function request<T>(path: string, options: RequestOptions = {}): Promise<T> {\n        return run<T>(path, options, decodeByContentType);\n    }\n\n    async function upload<T>(\n        path: string,\n        formData: FormData,\n        method: \"POST\" | \"PUT\" | \"PATCH\" = \"POST\",\n        options?: Omit<RequestOptions, \"body\" | \"method\">,\n    ): Promise<T> {\n        return request<T>(path, { ...options, method, body: formData });\n    }\n\n    return {\n        request,\n        get: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"GET\" }),\n        post: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"POST\" }),\n        put: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"PUT\" }),\n        patch: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"PATCH\" }),\n        delete: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"DELETE\" }),\n        blob: (path: string, options?: RequestOptions) =>\n            run<Blob>(path, { ...options }, (response) => response.blob()),\n        arrayBuffer: (path: string, options?: RequestOptions) =>\n            run<ArrayBuffer>(path, { ...options }, (response) => response.arrayBuffer()),\n        upload,\n    };\n}\n"],"mappings":";;;;;;;;;AA8BA,IAAMC,oBAA0C,IAAI,IAAI;CAAC;CAAO;CAAQ;AAAS,CAAC;AAoBlF,SAASC,EAAmB,GAAgB,GAAyB;CAGjE,OAFI,CAACD,EAAmB,IAAIE,CAAM,KAC9B,EAAEC,aAAiBC,KAAyB,KACzCC,EAAkBF,EAAM,MAAM;AACzC;AAQA,SAASG,EAAa,GAAiE;CAEnF,OADKC,IACEA,MAAW,KAAO,CAAC,IAAIA,IADV;AAExB;AAGA,IAAMC,IAAkB,MAGlBC,IAAyB;AAE/B,SAASC,EAAW,GAAiC;CACjD,OAAO,OAAO,WAAa,OAAeC,aAAgB;AAC9D;AAaA,SAASC,EAAU,GAA2B;CAC1C,OAAO,KAAK,MAAM,YAAY,IAAI,IAAIC,CAAS;AACnD;AAEA,eAAeC,EAAW,GAAoB,GAAkD;CAC5F,IAAIH;CACJ,IAAI;EACA,IAAO,MAAMI,EAAS,MAAM,CAAC,CAAC,KAAK;CACvC,QAAQ;EACJ,IAAI;GACA,IAAO,MAAMA,EAAS,KAAK;EAC/B,QAAQ;GACJ,IAAO;EACX;CACJ;CACA,OAAO,IAAIX,EACPY,EAAcD,EAAS,QAAQJ,GAAMI,EAAS,SAASE,CAAa,CACxE;AACJ;AA0DA,SAAgBC,EAAgB,GAAoC;CAChE,IAAMC,IAAUZ,EAAO,WAAW,WAAW,MAAM,KAAK,UAAU;CAalE,SAASa,EAAY,GAAa,GAA2C;EACzE,IAAIC,GAAU,OAAO,CAAC;EACtB,IAAMC,IAAQf,EAAO,WAAW;EAMhC,OALKe,IACAC,EAA0BC,GAAKjB,EAAO,SAASA,EAAO,cAAc,IAIlE,EAAE,eAAe,UAAUe,IAAQ,KAHtCG,EAA2BD,GAAKjB,EAAO,OAAO,GACvC,CAAC,KAHO,CAAC;CAMxB;CAEA,eAAemB,EACX,GACA,GACA,GACA,GACiB;EACjB,IAAM,EAAE,SAAM,WAAQ,YAAS,WAAQ,YAAS,GAAGC,MAASC,GACtDC,IAASnB,EAAWC,CAAI,GACxBmB,IAAaD,IAAStB,EAAO,gBAAgBA,EAAO,SAEpDwB,IACFC,MAAY,KAAA,IAAsBF,MAAe,KAAA,IAFpCD,IAASpB,IAAyBD,IAEcsB,IAArCE,GAEtBR,IAAMS,EAAY1B,EAAO,SAAS2B,GAAM;GAAE,QAAQ3B,EAAO;GAAQ;EAAO,CAAC,GAEzE4B,IAAgBC,GAChBC,IAAuC;GACzC,GAAIR,IAAS,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;GACvD,GAAIS,IAAY,EAAE,gBAAgBA,EAAU,IAAI,CAAC;GACjD,GAAG/B,EAAO;GACV,GAAGa,EAAYI,GAAKH,CAAQ;GAC5B,GAAGkB,EAAY;IACX,QAAQZ,EAAK,UAAU;IACvB;IACA,WAAWpB,EAAO;IAClB,MAAMA,EAAO;IACb,gBAAgBA,EAAO;IACvB,SAAS;KAAE,GAAGA,EAAO;KAAS,GAAG4B;IAAc;GACnD,CAAC;GACD,GAAGA;EACP,GAEMK,IAAQC,EAAYC,GAAQX,CAAK,GACjCY,IAAoB;GACtB,GAAGhB;GACH,QAAQa,EAAM;GACd,SAASH;GACT,aAAa9B,EAAO,kBAAkB,YAAYoB,EAAK;GACvD,MACIhB,KAA+B,OACzB,KAAA,IACAkB,IACGlB,IACD,KAAK,UAAUA,CAAI;EACnC;EAEA,IAAI;GACA,OAAO,MAAMQ,EAAQK,GAAKmB,CAAI;EAClC,SAASC,GAAO;GAOZ,MANIJ,EAAM,SAAS,IACT,IAAIpC,EAAgB;IACtB,QAAQ;IACR,QAAQ,wBAAwB2B,EAAM;GAC1C,CAAC,IAECa;EACV,UAAU;GACN,EAAM,QAAQ;EAClB;CACJ;CAEA,eAAeC,EACX,GACA,GACA,GACA,GACA,GACiB;EACjB,IAAMC,IAAMvC,EAAO;EACnB,IAAI,CAACuC,GAAK,OAAOpB,EAAWQ,GAAMN,GAASU,GAAWjB,CAAQ;EAE9D,IAAMR,IAAY,YAAY,IAAI;EAClC,IAAI;GACA,IAAME,IAAW,MAAMW,EAAWQ,GAAMN,GAASU,GAAWjB,CAAQ,GAC9D0B,IAAQ;IAAE;IAAW,QAAQhC,EAAS;IAAQ,IAAIH,EAAUC,CAAS;GAAE,GACvEmC,IAAO,GAAG9C,EAAO,GAAGgC,EAAK,KAAKnB,EAAS;GAG7C,OAFIA,EAAS,UAAU,MAAK+B,EAAI,KAAKE,GAAMD,CAAK,IAC3CD,EAAI,MAAME,GAAMD,CAAK,GACnBhC;EACX,SAASZ,GAAO;GAMZ,MALA2C,EAAI,KAAK,GAAG5C,EAAO,GAAGgC,EAAK,iBAAiB;IACxC;IACA,IAAItB,EAAUC,CAAS;IACvB;GACJ,CAAC,GACKV;EACV;CACJ;CAWA,eAAe8C,EACX,GACA,GACA,GACa;EACb,IAAK1C,EAAO,gBACZ;KAAO,QAAQ,KAAK,yCAAyC;IACzD;IACA,QAAQQ,EAAS;GACrB,CAAC;GACD,IAAI;IACA,MAAMR,EAAO,eAAeQ,GAAUmC,CAAO;GACjD,SAAS/C,GAAO;IACZ,IAAIA,aAAiBgD,GAAwB,MAAMhD;IACnD,EAAO,QAAQ,KAAK,8DAA8D;KAC9E;KACA,QAAQY,EAAS;KACjB;IACJ,CAAC;GACL;EAVC;CAWL;CASA,SAASqC,EAAY,GAAuC;EACxD,OAAO;GACH,OAAO/B,IAAW,OAAQd,EAAO,WAAW,KAAK;GACjD,OAAOA,EAAO,kBAAkB,KAAK;EACzC;CACJ;CAEA,eAAe8C,EACX,GACA,GACA,GACU;EACV,IAAM,EAAE,cAAW,IAAO,mBAAgB,IAAO,GAAGV,MAASf,GACvDU,IAAY/B,EAAO,YAAYA,EAAO,UAAU,IAAI+C,EAAS,GAC7DpD,KAAUyC,EAAK,UAAU,MAAA,CAAO,YAAY,GAC5CY,IAAOH,EAAY/B,CAAQ,GAC7BN,IAAW,MAAM8B,EAAKX,GAAMS,GAAML,GAAWpC,GAAQmB,CAAQ;EAEjE,IAAIN,EAAS,WAAW,OAAO,CAACM,KAAY,CAACmC,GAAe;GACxD,IAAIjD,EAAO,SAAS;IAChB,IAAIkD;IACJ,IAAI;KAGA,AAFA,MAAMlD,EAAO,QAAQgD,CAAI,GACzB,IAAWH,EAAY/B,CAAQ,GAC/B,IAAW,MAAMwB,EAAKX,GAAMS,GAAML,GAAWpC,GAAQmB,CAAQ;IACjE,SAASlB,GAAO;KAGZ,MAFIA,aAAiBgD,IAA8BhD,KACnD,MAAM8C,EAAmBlC,GAAUuB,GAAWiB,CAAI,GAC5C,MAAMzC,EAAWC,GAAUuB,CAAS;IAC9C;IACA,AAAIvB,EAAS,WAAW,OACpB,MAAMkC,EAAmBlC,GAAUuB,GAAWmB,CAAQ;GAE9D,OACI,MAAMR,EAAmBlC,GAAUuB,GAAWiB,CAAI;EAE1D;EAEA,IAAI,CAACxC,EAAS,IACV,MAAM,MAAMD,EAAWC,GAAUuB,CAAS;EAG9C,OAAOoB,EAAO3C,CAAQ;CAC1B;CAEA,eAAe4C,EACX,GACA,GACA,GACU;EACV,IAAM,EAAE,OAAOC,GAAY,GAAGjC,MAASC,GACjCiC,IAAevD,EAAasD,MAAe,KAAA,IAAyBrD,EAAO,QAApBqD,CAAyB;EACtF,IAAI,CAACC,GAAc,OAAOR,EAAWnB,GAAMP,GAAM+B,CAAM;EAEvD,IAAMxD,KAAUyB,EAAK,UAAU,MAAA,CAAO,YAAY;EAClD,OAAO5B,QAAuBsD,EAAWnB,GAAMP,GAAM+B,CAAM,GAAG;GAC1D,GAAGG;GACH,aACIA,EAAa,iBAAiB,MAAmB5D,EAAmBE,GAAOD,CAAM;EACzF,CAAC;CACL;CAEA,eAAe6D,EAAW,GAAc,IAA0B,CAAC,GAAe;EAC9E,OAAOJ,EAAOzB,GAAMN,GAASoC,CAAmB;CACpD;CAEA,eAAeC,EACX,GACA,GACA,IAAmC,QACnC,GACU;EACV,OAAOF,EAAW7B,GAAM;GAAE,GAAGN;GAAS;GAAQ,MAAMsC;EAAS,CAAC;CAClE;CAEA,OAAO;EACH;EACA,MAAS,GAAc,MACnBH,EAAW7B,GAAM;GAAE,GAAGN;GAAS,QAAQ;EAAM,CAAC;EAClD,OAAU,GAAc,MACpBmC,EAAW7B,GAAM;GAAE,GAAGN;GAAS,QAAQ;EAAO,CAAC;EACnD,MAAS,GAAc,MACnBmC,EAAW7B,GAAM;GAAE,GAAGN;GAAS,QAAQ;EAAM,CAAC;EAClD,QAAW,GAAc,MACrBmC,EAAW7B,GAAM;GAAE,GAAGN;GAAS,QAAQ;EAAQ,CAAC;EACpD,SAAY,GAAc,MACtBmC,EAAW7B,GAAM;GAAE,GAAGN;GAAS,QAAQ;EAAS,CAAC;EACrD,OAAO,GAAc,MACjB+B,EAAUzB,GAAM,EAAE,GAAGN,EAAQ,IAAI,MAAab,EAAS,KAAK,CAAC;EACjE,cAAc,GAAc,MACxB4C,EAAiBzB,GAAM,EAAE,GAAGN,EAAQ,IAAI,MAAab,EAAS,YAAY,CAAC;EAC/E;CACJ;AACJ"}
+{"version":3,"file":"api-client.js","names":["retryWithBackoff","IDEMPOTENT_METHODS","isRetriableFailure","method","error","TempestApiError","isRetriableStatus","resolveRetry","config","DEFAULT_TIMEOUT","DEFAULT_UPLOAD_TIMEOUT","isFormData","body","elapsedMs","startedAt","pathForLog","path","parseError","response","buildApiError","sentRequestId","createApiClient","fetcher","authHeaders","skipAuth","token","isTrustedCredentialTarget","url","reportSuppressedCredential","rawRequest","rest","options","isForm","configured","limit","timeout","buildApiUrl","callerHeaders","headers","finalHeaders","requestId","csrfHeaders","timed","withTimeout","signal","init","cause","send","log","target","entry","line","notifyUnauthorized","context","SessionSupersededError","authContext","attempt","randomId","sent","skipAuthRetry","replayed","decode","run","perRequest","retryOptions","retry","request","decodeByContentType","upload","formData"],"sources":["../../src/http/api-client.ts"],"sourcesContent":["/**\n * @tempest-limits function-lines — createApiClient is over the limit and every line\n * is a request-lifecycle concern the client cannot delegate: base URL joining, the\n * auth header, the 401 refresh-and-replay, the opt-in retry wrapper and the response\n * parsing that turns a failure into a typed error.\n */\nimport { randomId } from \"../utils\";\nimport { buildApiUrl } from \"./build-url\";\nimport { isTrustedCredentialTarget, reportSuppressedCredential } from \"./credential-scope\";\nimport { csrfHeaders } from \"./csrf\";\nimport { decodeByContentType } from \"./decode-response\";\nimport type { ResponseDecoder } from \"./decode-response\";\nimport {\n    buildApiError,\n    SessionSupersededError,\n    TempestApiError,\n    isRetriableStatus,\n} from \"./errors\";\nimport { retry as retryWithBackoff } from \"./retry\";\nimport type { RetryOptions } from \"./retry\";\nimport { withTimeout } from \"./timeout\";\nimport type { ApiClient, ApiClientConfig, RequestAuthContext, RequestOptions } from \"./types\";\n\n/**\n * Methods the built-in retry policy will replay.\n *\n * `PUT` and `DELETE` are idempotent on paper but stay out: a backend that logs,\n * bills, or fires a webhook per call still sees two, so replaying them is a\n * decision the caller makes through `shouldRetry`, not a default.\n */\nconst IDEMPOTENT_METHODS: ReadonlySet<string> = new Set([\"GET\", \"HEAD\", \"OPTIONS\"]);\n\n/**\n * Sub-500 statuses worth a second attempt: a network failure (status `0`), a\n * request timeout, a too-early replay, and a rate limit — which usually carries\n * the `Retry-After` the backoff already honours.\n */\n\n/**\n * The built-in retry policy, used when `retry` is `true` or is options carrying\n * no `shouldRetry` of their own.\n *\n * Conservative on purpose. Replaying a write can duplicate it, and replaying a\n * `400` or a `403` cannot fix a bad payload or a permission the caller does not\n * have — it only spends the user's time before showing the same error.\n *\n * @param error - Whatever the attempt threw.\n * @param method - The upper-cased HTTP method of the request.\n * @returns Whether the client should try again.\n */\nfunction isRetriableFailure(error: unknown, method: string): boolean {\n    if (!IDEMPOTENT_METHODS.has(method)) return false;\n    if (!(error instanceof TempestApiError)) return false;\n    return isRetriableStatus(error.status);\n}\n\n/**\n * Normalize the `retry` config into options, or `null` when retrying is off.\n *\n * @param config - The `retry` field as the caller wrote it.\n * @returns Retry options to use, or `null` to run a single attempt.\n */\nfunction resolveRetry(config: boolean | RetryOptions | undefined): RetryOptions | null {\n    if (!config) return null;\n    return config === true ? {} : config;\n}\n\n/** Default milliseconds before a request is abandoned. */\nconst DEFAULT_TIMEOUT = 15_000;\n\n/** Default milliseconds before a `FormData` request is abandoned. */\nconst DEFAULT_UPLOAD_TIMEOUT = 300_000;\n\nfunction isFormData(body: unknown): body is FormData {\n    return typeof FormData !== \"undefined\" && body instanceof FormData;\n}\n\n/**\n * Milliseconds since a `performance.now()` reading, rounded.\n *\n * `performance.now()` rather than `Date.now()` because this measures a\n * duration: the wall clock can step sideways mid-request (an NTP correction, a\n * VM resuming, the user changing the clock) and turn a 40 ms call into a\n * negative number. The monotonic clock cannot.\n *\n * @param startedAt - The reading taken before the work started.\n * @returns Whole milliseconds elapsed.\n */\nfunction elapsedMs(startedAt: number): number {\n    return Math.round(performance.now() - startedAt);\n}\n\n/**\n * The request path as the log line shows it: no query, no fragment, no userinfo.\n *\n * The logger promises never to write the query string, and `params` was never\n * the only way one gets in: a call site can write `\"/files?access_token=…\"`\n * inline, and an absolute path — the signed upload endpoint or CDN URL that\n * `buildApiUrl` passes through untouched — carries its signature in the query\n * and may carry `user:password@` in the authority. Everything from the first\n * `?` or `#` is dropped and the userinfo of an absolute (or scheme-relative)\n * URL is removed; the host and the path stay, because they are what makes the\n * line useful. Pure string work, no `URL` round trip, so a path that would not\n * parse is still logged instead of throwing inside the logging branch.\n *\n * @param path - The path exactly as the call site passed it.\n * @returns The path without query, fragment or credentials.\n */\nfunction pathForLog(path: string): string {\n    return path.replace(/[?#][^]*/, \"\").replace(/^([^/]*\\/\\/)[^/]*@/, \"$1\");\n}\n\nasync function parseError(response: Response, sentRequestId?: string): Promise<TempestApiError> {\n    let body: unknown;\n    try {\n        body = await response.clone().json();\n    } catch {\n        try {\n            body = await response.text();\n        } catch {\n            body = null;\n        }\n    }\n    return new TempestApiError(\n        buildApiError(response.status, body, response.headers, sentRequestId),\n    );\n}\n\n/**\n * Create a typed HTTP client backed by `fetch`.\n *\n * Handles JSON serialization, query params, bearer auth via `getToken`, uploads\n * via `FormData`, and throws a typed `ApiError` on any non-2xx response.\n *\n * **Expired sessions.** A `401` with `refresh` configured awaits the refresh and\n * replays the request once. `onUnauthorized` fires whenever that path ends\n * unauthorized anyway — the refresh threw, or the replay came back `401` — which\n * is the signal to clear the session. Without `refresh`, the first `401` calls\n * it directly.\n *\n * **Binary bodies** have their own methods — `blob()` and `arrayBuffer()` — which\n * run the same pipeline and skip the parse. `request()` no longer decodes an\n * unknown `Content-Type` as text either: it returns a `Blob` and says so once in\n * a development build, because reading `image/jpeg` as UTF-8 destroyed the bytes\n * on the way in.\n *\n * **The bearer token is scoped to `baseURL`'s origin** since 0.66.0. A path may\n * be an absolute URL, which overrides the base entirely, so without a scope the\n * destination of a credentialed request could come from a value read off the\n * network. A request to another origin still goes out; it goes without the\n * header, and a development build says so once. Declare the exceptions in\n * {@link ApiClientConfig.trustedOrigins}.\n *\n * **CSRF** is off unless you set `csrf`. With it, every unsafe request (anything\n * but `GET`/`HEAD`/`OPTIONS`/`TRACE`) echoes the `csrf_token` cookie in an\n * `X-CSRF-Token` header — the double-submit contract of `tempest-fastapi-sdk`'s\n * `CSRFMiddleware` — scoped to the same origins as the bearer token and sent on\n * `skipAuth` requests too. See {@link ApiClientConfig.csrf}.\n *\n * **Retries** are off unless you set `retry`. See {@link ApiClientConfig.retry}\n * for the built-in policy; it never replays a write. A single call overrides it\n * with {@link RequestOptions.retry}, and opts out of auth entirely with\n * {@link RequestOptions.skipAuth}.\n *\n * **Logging** is off unless you pass a `logger`. With one, every finished attempt\n * writes a line — `debug` under 400, `warn` from 400 up, plus a `warn` when\n * `onUnauthorized` fires — carrying `requestId`, `status` and elapsed `ms`, and\n * never a body, header or query string. The level and the destination belong to\n * the logger, not to a boolean here.\n *\n * @example\n * const api = createApiClient({\n *     baseURL: import.meta.env.VITE_API_URL,\n *     getToken: () => useAuthStore.getState().token,\n *     refresh,\n *     onUnauthorized: () => useAuthStore.getState().logout(),\n *     logger: createLogger({ level: import.meta.env.DEV ? \"debug\" : \"warn\" }).child(\"http\"),\n *     retry: true,\n * });\n *\n * @param config - Base URL plus the optional auth, retry and fetch hooks.\n * @returns A client with `request`/`get`/`post`/`put`/`patch`/`delete`/`blob`/\n * `arrayBuffer`/`upload`.\n */\nexport function createApiClient(config: ApiClientConfig): ApiClient {\n    const fetcher = config.fetcher ?? globalThis.fetch.bind(globalThis);\n\n    /**\n     * The `Authorization` header for a request, or nothing.\n     *\n     * Takes the resolved URL rather than reading `config.baseURL`, because an\n     * absolute path overrides the base entirely (see `buildApiUrl`) and the\n     * credential is scoped to an origin, not to a client.\n     *\n     * @param url - The absolute URL the request is going to.\n     * @param skipAuth - Whether the caller opted this request out of auth.\n     * @returns The header, or an empty object.\n     */\n    function authHeaders(url: string, skipAuth: boolean): Record<string, string> {\n        if (skipAuth) return {};\n        const token = config.getToken?.();\n        if (!token) return {};\n        if (!isTrustedCredentialTarget(url, config.baseURL, config.trustedOrigins)) {\n            reportSuppressedCredential(url, config.baseURL);\n            return {};\n        }\n        return { Authorization: `Bearer ${token}` };\n    }\n\n    async function rawRequest(\n        path: string,\n        options: RequestOptions,\n        requestId: string | undefined,\n        skipAuth: boolean,\n    ): Promise<Response> {\n        const { body, params, headers, signal, timeout, ...rest } = options;\n        const isForm = isFormData(body);\n        const configured = isForm ? config.uploadTimeout : config.timeout;\n        const fallback = isForm ? DEFAULT_UPLOAD_TIMEOUT : DEFAULT_TIMEOUT;\n        const limit =\n            timeout !== undefined ? timeout : configured !== undefined ? configured : fallback;\n\n        const url = buildApiUrl(config.baseURL, path, { prefix: config.prefix, params });\n\n        const callerHeaders = headers as Record<string, string> | undefined;\n        const finalHeaders: Record<string, string> = {\n            ...(isForm ? {} : { \"Content-Type\": \"application/json\" }),\n            ...(requestId ? { \"X-Request-ID\": requestId } : {}),\n            ...config.headers,\n            ...authHeaders(url, skipAuth),\n            ...csrfHeaders({\n                method: rest.method ?? \"GET\",\n                url,\n                reference: config.baseURL,\n                csrf: config.csrf,\n                trustedOrigins: config.trustedOrigins,\n                headers: { ...config.headers, ...callerHeaders },\n            }),\n            ...callerHeaders,\n        };\n\n        const timed = withTimeout(signal, limit);\n        const init: RequestInit = {\n            ...rest,\n            signal: timed.signal,\n            headers: finalHeaders,\n            credentials: config.withCredentials ? \"include\" : rest.credentials,\n            body:\n                body === undefined || body === null\n                    ? undefined\n                    : isForm\n                      ? (body as FormData)\n                      : JSON.stringify(body),\n        };\n\n        try {\n            return await fetcher(url, init);\n        } catch (cause) {\n            if (timed.timedOut()) {\n                throw new TempestApiError({\n                    status: 0,\n                    detail: `A requisição excedeu ${limit}ms e foi abandonada.`,\n                });\n            }\n            throw cause;\n        } finally {\n            timed.dispose();\n        }\n    }\n\n    async function send(\n        path: string,\n        options: RequestOptions,\n        requestId: string,\n        method: string,\n        skipAuth: boolean,\n    ): Promise<Response> {\n        const log = config.logger;\n        if (!log) return rawRequest(path, options, requestId, skipAuth);\n\n        const target = `${method} ${pathForLog(path)}`;\n        const startedAt = performance.now();\n        try {\n            const response = await rawRequest(path, options, requestId, skipAuth);\n            const entry = { requestId, status: response.status, ms: elapsedMs(startedAt) };\n            const line = `${target} → ${response.status}`;\n            if (response.status >= 400) log.warn(line, entry);\n            else log.debug(line, entry);\n            return response;\n        } catch (error) {\n            log.warn(`${target} → no response`, {\n                requestId,\n                ms: elapsedMs(startedAt),\n                error,\n            });\n            throw error;\n        }\n    }\n\n    /**\n     * Call `onUnauthorized`, keeping the request's own error unless the hook\n     * says the attempt belongs to an ended session.\n     *\n     * @param response - The `401` that ended the attempt.\n     * @param requestId - Correlation id for the log.\n     * @param context - The credential and session the attempt left with.\n     * @throws {SessionSupersededError} When `onUnauthorized` threw it.\n     */\n    async function notifyUnauthorized(\n        response: Response,\n        requestId: string,\n        context: RequestAuthContext,\n    ): Promise<void> {\n        if (!config.onUnauthorized) return;\n        config.logger?.warn(`unauthorized — calling onUnauthorized`, {\n            requestId,\n            status: response.status,\n        });\n        try {\n            await config.onUnauthorized(response, context);\n        } catch (error) {\n            if (error instanceof SessionSupersededError) throw error;\n            config.logger?.warn(`onUnauthorized threw — keeping the original response error`, {\n                requestId,\n                status: response.status,\n                error,\n            });\n        }\n    }\n\n    /**\n     * The credential and session an attempt leaves with, read just before it is\n     * sent.\n     *\n     * @param skipAuth - Whether the attempt goes out without credentials.\n     * @returns The context handed to `refresh` and `onUnauthorized`.\n     */\n    function authContext(skipAuth: boolean): RequestAuthContext {\n        return {\n            token: skipAuth ? null : (config.getToken?.() ?? null),\n            epoch: config.getSessionEpoch?.() ?? null,\n        };\n    }\n\n    async function attempt<T>(\n        path: string,\n        options: RequestOptions,\n        decode: ResponseDecoder<T>,\n    ): Promise<T> {\n        const { skipAuth = false, skipAuthRetry = false, ...init } = options;\n        const requestId = config.requestId ? config.requestId() : randomId();\n        const method = (init.method ?? \"GET\").toUpperCase();\n        const sent = authContext(skipAuth);\n        let response = await send(path, init, requestId, method, skipAuth);\n\n        if (response.status === 401 && !skipAuth && !skipAuthRetry) {\n            if (config.refresh) {\n                let replayed: RequestAuthContext;\n                try {\n                    await config.refresh(sent);\n                    replayed = authContext(skipAuth);\n                    response = await send(path, init, requestId, method, skipAuth);\n                } catch (error) {\n                    if (error instanceof SessionSupersededError) throw error;\n                    await notifyUnauthorized(response, requestId, sent);\n                    throw await parseError(response, requestId);\n                }\n                if (response.status === 401) {\n                    await notifyUnauthorized(response, requestId, replayed);\n                }\n            } else {\n                await notifyUnauthorized(response, requestId, sent);\n            }\n        }\n\n        if (!response.ok) {\n            throw await parseError(response, requestId);\n        }\n\n        return decode(response);\n    }\n\n    async function run<T>(\n        path: string,\n        options: RequestOptions,\n        decode: ResponseDecoder<T>,\n    ): Promise<T> {\n        const { retry: perRequest, ...rest } = options;\n        const retryOptions = resolveRetry(perRequest !== undefined ? perRequest : config.retry);\n        if (!retryOptions) return attempt<T>(path, rest, decode);\n\n        const method = (rest.method ?? \"GET\").toUpperCase();\n        return retryWithBackoff(() => attempt<T>(path, rest, decode), {\n            ...retryOptions,\n            shouldRetry:\n                retryOptions.shouldRetry ?? ((error: unknown) => isRetriableFailure(error, method)),\n        });\n    }\n\n    async function request<T>(path: string, options: RequestOptions = {}): Promise<T> {\n        return run<T>(path, options, decodeByContentType);\n    }\n\n    async function upload<T>(\n        path: string,\n        formData: FormData,\n        method: \"POST\" | \"PUT\" | \"PATCH\" = \"POST\",\n        options?: Omit<RequestOptions, \"body\" | \"method\">,\n    ): Promise<T> {\n        return request<T>(path, { ...options, method, body: formData });\n    }\n\n    return {\n        request,\n        get: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"GET\" }),\n        post: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"POST\" }),\n        put: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"PUT\" }),\n        patch: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"PATCH\" }),\n        delete: <T>(path: string, options?: RequestOptions) =>\n            request<T>(path, { ...options, method: \"DELETE\" }),\n        blob: (path: string, options?: RequestOptions) =>\n            run<Blob>(path, { ...options }, (response) => response.blob()),\n        arrayBuffer: (path: string, options?: RequestOptions) =>\n            run<ArrayBuffer>(path, { ...options }, (response) => response.arrayBuffer()),\n        upload,\n        url: (path: string, params?: RequestOptions[\"params\"]) =>\n            buildApiUrl(config.baseURL, path, { prefix: config.prefix, params }),\n    };\n}\n"],"mappings":";;;;;;;;;AA8BA,IAAMC,oBAA0C,IAAI,IAAI;CAAC;CAAO;CAAQ;AAAS,CAAC;AAoBlF,SAASC,EAAmB,GAAgB,GAAyB;CAGjE,OAFI,CAACD,EAAmB,IAAIE,CAAM,KAC9B,EAAEC,aAAiBC,KAAyB,KACzCC,EAAkBF,EAAM,MAAM;AACzC;AAQA,SAASG,EAAa,GAAiE;CAEnF,OADKC,IACEA,MAAW,KAAO,CAAC,IAAIA,IADV;AAExB;AAGA,IAAMC,IAAkB,MAGlBC,IAAyB;AAE/B,SAASC,EAAW,GAAiC;CACjD,OAAO,OAAO,WAAa,OAAeC,aAAgB;AAC9D;AAaA,SAASC,EAAU,GAA2B;CAC1C,OAAO,KAAK,MAAM,YAAY,IAAI,IAAIC,CAAS;AACnD;AAkBA,SAASC,EAAW,GAAsB;CACtC,OAAOC,EAAK,QAAQ,YAAY,EAAE,CAAC,CAAC,QAAQ,sBAAsB,IAAI;AAC1E;AAEA,eAAeC,EAAW,GAAoB,GAAkD;CAC5F,IAAIL;CACJ,IAAI;EACA,IAAO,MAAMM,EAAS,MAAM,CAAC,CAAC,KAAK;CACvC,QAAQ;EACJ,IAAI;GACA,IAAO,MAAMA,EAAS,KAAK;EAC/B,QAAQ;GACJ,IAAO;EACX;CACJ;CACA,OAAO,IAAIb,EACPc,EAAcD,EAAS,QAAQN,GAAMM,EAAS,SAASE,CAAa,CACxE;AACJ;AA0DA,SAAgBC,EAAgB,GAAoC;CAChE,IAAMC,IAAUd,EAAO,WAAW,WAAW,MAAM,KAAK,UAAU;CAalE,SAASe,EAAY,GAAa,GAA2C;EACzE,IAAIC,GAAU,OAAO,CAAC;EACtB,IAAMC,IAAQjB,EAAO,WAAW;EAMhC,OALKiB,IACAC,EAA0BC,GAAKnB,EAAO,SAASA,EAAO,cAAc,IAIlE,EAAE,eAAe,UAAUiB,IAAQ,KAHtCG,EAA2BD,GAAKnB,EAAO,OAAO,GACvC,CAAC,KAHO,CAAC;CAMxB;CAEA,eAAeqB,EACX,GACA,GACA,GACA,GACiB;EACjB,IAAM,EAAE,SAAM,WAAQ,YAAS,WAAQ,YAAS,GAAGC,MAASC,GACtDC,IAASrB,EAAWC,CAAI,GACxBqB,IAAaD,IAASxB,EAAO,gBAAgBA,EAAO,SAEpD0B,IACFC,MAAY,KAAA,IAAsBF,MAAe,KAAA,IAFpCD,IAAStB,IAAyBD,IAEcwB,IAArCE,GAEtBR,IAAMS,EAAY5B,EAAO,SAASQ,GAAM;GAAE,QAAQR,EAAO;GAAQ;EAAO,CAAC,GAEzE6B,IAAgBC,GAChBC,IAAuC;GACzC,GAAIP,IAAS,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;GACvD,GAAIQ,IAAY,EAAE,gBAAgBA,EAAU,IAAI,CAAC;GACjD,GAAGhC,EAAO;GACV,GAAGe,EAAYI,GAAKH,CAAQ;GAC5B,GAAGiB,EAAY;IACX,QAAQX,EAAK,UAAU;IACvB;IACA,WAAWtB,EAAO;IAClB,MAAMA,EAAO;IACb,gBAAgBA,EAAO;IACvB,SAAS;KAAE,GAAGA,EAAO;KAAS,GAAG6B;IAAc;GACnD,CAAC;GACD,GAAGA;EACP,GAEMK,IAAQC,EAAYC,GAAQV,CAAK,GACjCW,IAAoB;GACtB,GAAGf;GACH,QAAQY,EAAM;GACd,SAASH;GACT,aAAa/B,EAAO,kBAAkB,YAAYsB,EAAK;GACvD,MACIlB,KAA+B,OACzB,KAAA,IACAoB,IACGpB,IACD,KAAK,UAAUA,CAAI;EACnC;EAEA,IAAI;GACA,OAAO,MAAMU,EAAQK,GAAKkB,CAAI;EAClC,SAASC,GAAO;GAOZ,MANIJ,EAAM,SAAS,IACT,IAAIrC,EAAgB;IACtB,QAAQ;IACR,QAAQ,wBAAwB6B,EAAM;GAC1C,CAAC,IAECY;EACV,UAAU;GACN,EAAM,QAAQ;EAClB;CACJ;CAEA,eAAeC,EACX,GACA,GACA,GACA,GACA,GACiB;EACjB,IAAMC,IAAMxC,EAAO;EACnB,IAAI,CAACwC,GAAK,OAAOnB,EAAWb,GAAMe,GAASS,GAAWhB,CAAQ;EAE9D,IAAMyB,IAAS,GAAG9C,EAAO,GAAGY,EAAWC,CAAI,KACrCF,IAAY,YAAY,IAAI;EAClC,IAAI;GACA,IAAMI,IAAW,MAAMW,EAAWb,GAAMe,GAASS,GAAWhB,CAAQ,GAC9D0B,IAAQ;IAAE;IAAW,QAAQhC,EAAS;IAAQ,IAAIL,EAAUC,CAAS;GAAE,GACvEqC,IAAO,GAAGF,EAAO,KAAK/B,EAAS;GAGrC,OAFIA,EAAS,UAAU,MAAK8B,EAAI,KAAKG,GAAMD,CAAK,IAC3CF,EAAI,MAAMG,GAAMD,CAAK,GACnBhC;EACX,SAASd,GAAO;GAMZ,MALA4C,EAAI,KAAK,GAAGC,EAAO,iBAAiB;IAChC;IACA,IAAIpC,EAAUC,CAAS;IACvB;GACJ,CAAC,GACKV;EACV;CACJ;CAWA,eAAegD,EACX,GACA,GACA,GACa;EACb,IAAK5C,EAAO,gBACZ;KAAO,QAAQ,KAAK,yCAAyC;IACzD;IACA,QAAQU,EAAS;GACrB,CAAC;GACD,IAAI;IACA,MAAMV,EAAO,eAAeU,GAAUmC,CAAO;GACjD,SAASjD,GAAO;IACZ,IAAIA,aAAiBkD,GAAwB,MAAMlD;IACnD,EAAO,QAAQ,KAAK,8DAA8D;KAC9E;KACA,QAAQc,EAAS;KACjB;IACJ,CAAC;GACL;EAVC;CAWL;CASA,SAASqC,EAAY,GAAuC;EACxD,OAAO;GACH,OAAO/B,IAAW,OAAQhB,EAAO,WAAW,KAAK;GACjD,OAAOA,EAAO,kBAAkB,KAAK;EACzC;CACJ;CAEA,eAAegD,EACX,GACA,GACA,GACU;EACV,IAAM,EAAE,cAAW,IAAO,mBAAgB,IAAO,GAAGX,MAASd,GACvDS,IAAYhC,EAAO,YAAYA,EAAO,UAAU,IAAIiD,EAAS,GAC7DtD,KAAU0C,EAAK,UAAU,MAAA,CAAO,YAAY,GAC5Ca,IAAOH,EAAY/B,CAAQ,GAC7BN,IAAW,MAAM6B,EAAK/B,GAAM6B,GAAML,GAAWrC,GAAQqB,CAAQ;EAEjE,IAAIN,EAAS,WAAW,OAAO,CAACM,KAAY,CAACmC,GAAe;GACxD,IAAInD,EAAO,SAAS;IAChB,IAAIoD;IACJ,IAAI;KAGA,AAFA,MAAMpD,EAAO,QAAQkD,CAAI,GACzB,IAAWH,EAAY/B,CAAQ,GAC/B,IAAW,MAAMuB,EAAK/B,GAAM6B,GAAML,GAAWrC,GAAQqB,CAAQ;IACjE,SAASpB,GAAO;KAGZ,MAFIA,aAAiBkD,IAA8BlD,KACnD,MAAMgD,EAAmBlC,GAAUsB,GAAWkB,CAAI,GAC5C,MAAMzC,EAAWC,GAAUsB,CAAS;IAC9C;IACA,AAAItB,EAAS,WAAW,OACpB,MAAMkC,EAAmBlC,GAAUsB,GAAWoB,CAAQ;GAE9D,OACI,MAAMR,EAAmBlC,GAAUsB,GAAWkB,CAAI;EAE1D;EAEA,IAAI,CAACxC,EAAS,IACV,MAAM,MAAMD,EAAWC,GAAUsB,CAAS;EAG9C,OAAOqB,EAAO3C,CAAQ;CAC1B;CAEA,eAAe4C,EACX,GACA,GACA,GACU;EACV,IAAM,EAAE,OAAOC,GAAY,GAAGjC,MAASC,GACjCiC,IAAezD,EAAawD,MAAe,KAAA,IAAyBvD,EAAO,QAApBuD,CAAyB;EACtF,IAAI,CAACC,GAAc,OAAOR,EAAWxC,GAAMc,GAAM+B,CAAM;EAEvD,IAAM1D,KAAU2B,EAAK,UAAU,MAAA,CAAO,YAAY;EAClD,OAAO9B,QAAuBwD,EAAWxC,GAAMc,GAAM+B,CAAM,GAAG;GAC1D,GAAGG;GACH,aACIA,EAAa,iBAAiB,MAAmB9D,EAAmBE,GAAOD,CAAM;EACzF,CAAC;CACL;CAEA,eAAe+D,EAAW,GAAc,IAA0B,CAAC,GAAe;EAC9E,OAAOJ,EAAO9C,GAAMe,GAASoC,CAAmB;CACpD;CAEA,eAAeC,EACX,GACA,GACA,IAAmC,QACnC,GACU;EACV,OAAOF,EAAWlD,GAAM;GAAE,GAAGe;GAAS;GAAQ,MAAMsC;EAAS,CAAC;CAClE;CAEA,OAAO;EACH;EACA,MAAS,GAAc,MACnBH,EAAWlD,GAAM;GAAE,GAAGe;GAAS,QAAQ;EAAM,CAAC;EAClD,OAAU,GAAc,MACpBmC,EAAWlD,GAAM;GAAE,GAAGe;GAAS,QAAQ;EAAO,CAAC;EACnD,MAAS,GAAc,MACnBmC,EAAWlD,GAAM;GAAE,GAAGe;GAAS,QAAQ;EAAM,CAAC;EAClD,QAAW,GAAc,MACrBmC,EAAWlD,GAAM;GAAE,GAAGe;GAAS,QAAQ;EAAQ,CAAC;EACpD,SAAY,GAAc,MACtBmC,EAAWlD,GAAM;GAAE,GAAGe;GAAS,QAAQ;EAAS,CAAC;EACrD,OAAO,GAAc,MACjB+B,EAAU9C,GAAM,EAAE,GAAGe,EAAQ,IAAI,MAAab,EAAS,KAAK,CAAC;EACjE,cAAc,GAAc,MACxB4C,EAAiB9C,GAAM,EAAE,GAAGe,EAAQ,IAAI,MAAab,EAAS,YAAY,CAAC;EAC/E;EACA,MAAM,GAAc,MAChBkB,EAAY5B,EAAO,SAASQ,GAAM;GAAE,QAAQR,EAAO;GAAQ;EAAO,CAAC;CAC3E;AACJ"}

package/dist/http/build-url.cjs

@@ -1,2 +1,2 @@
-var e=/^[a-z][a-z\d+\-.]*:/i;function t(e){return e.split(`/`).filter(Boolean)}function n(e,t){return t.length===0||t.length>e.length?!1:t.every((t,n)=>e[n]===t)}function r(e){let t=globalThis.location?.origin;if(!t)throw TypeError(`createApiClient: baseURL "${e}" is relative and there is no location to resolve it against. Pass an absolute URL (https://api.example.com) outside the browser.`);return t}function i(t,n,r={}){let{prefix:i,params:o}=r,s=e.test(n)?new URL(n):new URL(a(t,n,i));if(o)for(let[e,t]of Object.entries(o))t!=null&&s.searchParams.set(e,String(t));return s.toString()}function a(i,a,o){let s=e.test(i)?new URL(i):new URL(i,r(i)),c=a.indexOf(`?`),l=c===-1?a:a.slice(0,c),u=c===-1?``:a.slice(c),d=[...t(s.pathname),...t(o??``)],f=t(l),p=n(f,d)?f:[...d,...f],m=l.endsWith(`/`)?`/`:``,h=p.length>0?`/${p.join(`/`)}${m}`:`/`;return`${s.origin}${h}${u}`}exports.buildApiUrl=i;
+var e=/^[a-z][a-z\d+\-.]*:/i;function t(e){return e.split(`/`).filter(Boolean)}function n(e,t){return t.length===0||t.length>e.length?!1:t.every((t,n)=>e[n]===t)}function r(e){let t=globalThis.location?.origin;if(!t)throw TypeError(`createApiClient: baseURL "${e}" is relative and there is no location to resolve it against. Pass an absolute URL (https://api.example.com) outside the browser.`);return t}function i(t,n,r={}){let{prefix:i,params:o}=r;if(e.test(n)&&!Object.values(o??{}).some(e=>e!=null))return n;let s=e.test(n)?new URL(n):new URL(a(t,n,i));if(o)for(let[e,t]of Object.entries(o))t!=null&&s.searchParams.set(e,String(t));return s.toString()}function a(i,a,o){let s=e.test(i)?new URL(i):new URL(i,r(i)),c=a.indexOf(`?`),l=c===-1?a:a.slice(0,c),u=c===-1?``:a.slice(c),d=[...t(s.pathname),...t(o??``)],f=t(l),p=n(f,d)?f:[...d,...f],m=l.endsWith(`/`)?`/`:``,h=p.length>0?`/${p.join(`/`)}${m}`:`/`;return`${s.origin}${h}${u}`}exports.buildApiUrl=i;
 //# sourceMappingURL=build-url.cjs.map

package/dist/http/build-url.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"build-url.cjs","names":["ABSOLUTE_URL","segments","path","startsWithSegments","prefix","index","segment","currentOrigin","origin","baseURL","buildApiUrl","options","url","resolve","params","key","value","base","queryStart","rawPath","query","basePath","requested","joined","trailing","pathname"],"sources":["../../src/http/build-url.ts"],"sourcesContent":["/**\n * Matches a path that already carries its own scheme (`https:`, `blob:`), which\n * makes it an absolute URL rather than something to resolve against the base.\n */\nconst ABSOLUTE_URL = /^[a-z][a-z\\d+\\-.]*:/i;\n\n/** Split a path into its non-empty segments, dropping surrounding slashes. */\nfunction segments(path: string): string[] {\n    return path.split(\"/\").filter(Boolean);\n}\n\n/**\n * Whether `path` already starts with every segment of `prefix`.\n *\n * Compared segment by segment, so a `/api` prefix is not considered present in\n * `/api-keys` — a plain `startsWith` would swallow the resource.\n *\n * @param path - Segments of the request path.\n * @param prefix - Segments of the base path.\n * @returns Whether the prefix is already applied.\n */\nfunction startsWithSegments(path: string[], prefix: string[]): boolean {\n    if (prefix.length === 0 || prefix.length > path.length) return false;\n    return prefix.every((segment, index) => path[index] === segment);\n}\n\n/**\n * Resolve the origin a relative `baseURL` hangs off.\n *\n * A base such as `\"/api\"` is the shape you get behind a dev-server proxy or a\n * reverse proxy that serves app and API from one host. It only means something\n * in a browsing context, so this throws with the config to fix rather than\n * letting `new URL` report `Invalid base URL` from three frames deeper.\n *\n * @param baseURL - The base as the caller wrote it.\n * @returns The origin to resolve against.\n * @throws When there is no `location` to borrow an origin from.\n */\nfunction currentOrigin(baseURL: string): string {\n    const origin = globalThis.location?.origin;\n    if (!origin) {\n        throw new TypeError(\n            `createApiClient: baseURL \"${baseURL}\" is relative and there is no location to resolve it against. Pass an absolute URL (https://api.example.com) outside the browser.`,\n        );\n    }\n    return origin;\n}\n\n/** Options accepted by {@link buildApiUrl}. */\nexport interface BuildApiUrlOptions {\n    /**\n     * Path segment every request is nested under, such as `\"/api\"`. Joined\n     * after the path the `baseURL` already carries.\n     */\n    prefix?: string;\n    /** Query params to append. `undefined` and `null` values are skipped. */\n    params?: Record<string, string | number | boolean | undefined | null>;\n}\n\n/**\n * Join a base URL, an optional prefix and a request path into an absolute URL.\n *\n * `new URL(path, base)` on its own is wrong for an API client. It follows the\n * URL spec, where a path starting with `/` is absolute against the *origin* and\n * therefore discards whatever path the base carried: a client on\n * `https://api.example.com/api` asked for `/auth/login` reaches\n * `https://api.example.com/auth/login`, and every request 404s with nothing in\n * the config that looks wrong. This function resolves the path against the base\n * *path* instead, so the leading slash is a matter of taste rather than a\n * silent 404, and `baseURL` + `prefix` are interchangeable ways to say the same\n * thing.\n *\n * The prefix is applied at most once: a path that already opens with it — say\n * `\"/api/auth/login\"` under a `\"/api\"` prefix — is left alone, so a codebase\n * migrating to `prefix` can move its call sites one at a time. The check is per\n * segment, so `/api-keys` is not mistaken for an already-prefixed path.\n *\n * A path that is itself an absolute URL wins over all of this, which is how a\n * client reaches a second host (a signed upload endpoint, a CDN) without a\n * second client.\n *\n * @example\n * buildApiUrl(\"https://api.example.com\", \"/auth/login\", { prefix: \"/api\" });\n * // \"https://api.example.com/api/auth/login\"\n *\n * buildApiUrl(\"https://api.example.com/api\", \"auth/login\");\n * // \"https://api.example.com/api/auth/login\"\n *\n * @param baseURL - Absolute base URL, or a path relative to the current origin.\n * @param path - The request path, or an absolute URL to use as-is.\n * @param options - Optional prefix and query params.\n * @returns The absolute URL to fetch.\n * @throws When `baseURL` is relative and there is no `location` to resolve it.\n */\nexport function buildApiUrl(\n    baseURL: string,\n    path: string,\n    options: BuildApiUrlOptions = {},\n): string {\n    const { prefix, params } = options;\n    const url = ABSOLUTE_URL.test(path) ? new URL(path) : new URL(resolve(baseURL, path, prefix));\n\n    if (params) {\n        for (const [key, value] of Object.entries(params)) {\n            if (value !== undefined && value !== null) {\n                url.searchParams.set(key, String(value));\n            }\n        }\n    }\n    return url.toString();\n}\n\n/**\n * Build the absolute URL string for a path that is not already absolute.\n *\n * Kept separate from {@link buildApiUrl} so the query-param loop is not nested\n * inside the joining rules.\n *\n * @param baseURL - Absolute base URL, or a path relative to the current origin.\n * @param path - The request path.\n * @param prefix - Optional segment every request is nested under.\n * @returns The joined absolute URL.\n */\nfunction resolve(baseURL: string, path: string, prefix?: string): string {\n    const base = ABSOLUTE_URL.test(baseURL)\n        ? new URL(baseURL)\n        : new URL(baseURL, currentOrigin(baseURL));\n\n    const queryStart = path.indexOf(\"?\");\n    const rawPath = queryStart === -1 ? path : path.slice(0, queryStart);\n    const query = queryStart === -1 ? \"\" : path.slice(queryStart);\n\n    const basePath = [...segments(base.pathname), ...segments(prefix ?? \"\")];\n    const requested = segments(rawPath);\n    const joined = startsWithSegments(requested, basePath)\n        ? requested\n        : [...basePath, ...requested];\n\n    const trailing = rawPath.endsWith(\"/\") ? \"/\" : \"\";\n    const pathname = joined.length > 0 ? `/${joined.join(\"/\")}${trailing}` : \"/\";\n    return `${base.origin}${pathname}${query}`;\n}\n"],"mappings":"AAIA,IAAMA,EAAe,uBAGrB,SAASC,EAAS,EAAwB,CACtC,OAAOC,EAAK,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO,CACzC,CAYA,SAASC,EAAmB,EAAgB,EAA2B,CAEnE,OADIC,EAAO,SAAW,GAAKA,EAAO,OAASF,EAAK,OAAe,GACxDE,EAAO,OAAO,EAAS,IAAUF,EAAKG,KAAWC,CAAO,CACnE,CAcA,SAASC,EAAc,EAAyB,CAC5C,IAAMC,EAAS,WAAW,UAAU,OACpC,GAAI,CAACA,EACD,MAAU,UACN,6BAA6BC,EAAQ,kIACzC,EAEJ,OAAOD,CACX,CAgDA,SAAgBE,EACZ,EACA,EACA,EAA8B,CAAC,EACzB,CACN,GAAM,CAAE,SAAQ,UAAWC,EACrBC,EAAMZ,EAAa,KAAKE,CAAI,EAAI,IAAI,IAAIA,CAAI,EAAI,IAAI,IAAIW,EAAQJ,EAASP,EAAME,CAAM,CAAC,EAE5F,GAAIU,EACK,IAAA,GAAM,CAACC,EAAKC,KAAU,OAAO,QAAQF,CAAM,EACxCE,GAAiC,MACjCJ,EAAI,aAAa,IAAIG,EAAK,OAAOC,CAAK,CAAC,EAInD,OAAOJ,EAAI,SAAS,CACxB,CAaA,SAASC,EAAQ,EAAiB,EAAc,EAAyB,CACrE,IAAMI,EAAOjB,EAAa,KAAKS,CAAO,EAChC,IAAI,IAAIA,CAAO,EACf,IAAI,IAAIA,EAASF,EAAcE,CAAO,CAAC,EAEvCS,EAAahB,EAAK,QAAQ,GAAG,EAC7BiB,EAAUD,IAAe,GAAKhB,EAAOA,EAAK,MAAM,EAAGgB,CAAU,EAC7DE,EAAQF,IAAe,GAAK,GAAKhB,EAAK,MAAMgB,CAAU,EAEtDG,EAAW,CAAC,GAAGpB,EAASgB,EAAK,QAAQ,EAAG,GAAGhB,EAASG,GAAU,EAAE,CAAC,EACjEkB,EAAYrB,EAASkB,CAAO,EAC5BI,EAASpB,EAAmBmB,EAAWD,CAAQ,EAC/CC,EACA,CAAC,GAAGD,EAAU,GAAGC,CAAS,EAE1BE,EAAWL,EAAQ,SAAS,GAAG,EAAI,IAAM,GACzCM,EAAWF,EAAO,OAAS,EAAI,IAAIA,EAAO,KAAK,GAAG,IAAIC,IAAa,IACzE,MAAO,GAAGP,EAAK,SAASQ,IAAWL,GACvC,C"}
+{"version":3,"file":"build-url.cjs","names":["ABSOLUTE_URL","segments","path","startsWithSegments","prefix","index","segment","currentOrigin","origin","baseURL","buildApiUrl","options","params","value","url","resolve","key","base","queryStart","rawPath","query","basePath","requested","joined","trailing","pathname"],"sources":["../../src/http/build-url.ts"],"sourcesContent":["/**\n * Matches a path that already carries its own scheme (`https:`, `blob:`), which\n * makes it an absolute URL rather than something to resolve against the base.\n */\nconst ABSOLUTE_URL = /^[a-z][a-z\\d+\\-.]*:/i;\n\n/** Split a path into its non-empty segments, dropping surrounding slashes. */\nfunction segments(path: string): string[] {\n    return path.split(\"/\").filter(Boolean);\n}\n\n/**\n * Whether `path` already starts with every segment of `prefix`.\n *\n * Compared segment by segment, so a `/api` prefix is not considered present in\n * `/api-keys` — a plain `startsWith` would swallow the resource.\n *\n * @param path - Segments of the request path.\n * @param prefix - Segments of the base path.\n * @returns Whether the prefix is already applied.\n */\nfunction startsWithSegments(path: string[], prefix: string[]): boolean {\n    if (prefix.length === 0 || prefix.length > path.length) return false;\n    return prefix.every((segment, index) => path[index] === segment);\n}\n\n/**\n * Resolve the origin a relative `baseURL` hangs off.\n *\n * A base such as `\"/api\"` is the shape you get behind a dev-server proxy or a\n * reverse proxy that serves app and API from one host. It only means something\n * in a browsing context, so this throws with the config to fix rather than\n * letting `new URL` report `Invalid base URL` from three frames deeper.\n *\n * @param baseURL - The base as the caller wrote it.\n * @returns The origin to resolve against.\n * @throws When there is no `location` to borrow an origin from.\n */\nfunction currentOrigin(baseURL: string): string {\n    const origin = globalThis.location?.origin;\n    if (!origin) {\n        throw new TypeError(\n            `createApiClient: baseURL \"${baseURL}\" is relative and there is no location to resolve it against. Pass an absolute URL (https://api.example.com) outside the browser.`,\n        );\n    }\n    return origin;\n}\n\n/** Options accepted by {@link buildApiUrl}. */\nexport interface BuildApiUrlOptions {\n    /**\n     * Path segment every request is nested under, such as `\"/api\"`. Joined\n     * after the path the `baseURL` already carries.\n     */\n    prefix?: string;\n    /** Query params to append. `undefined` and `null` values are skipped. */\n    params?: Record<string, string | number | boolean | undefined | null>;\n}\n\n/**\n * Join a base URL, an optional prefix and a request path into an absolute URL.\n *\n * `new URL(path, base)` on its own is wrong for an API client. It follows the\n * URL spec, where a path starting with `/` is absolute against the *origin* and\n * therefore discards whatever path the base carried: a client on\n * `https://api.example.com/api` asked for `/auth/login` reaches\n * `https://api.example.com/auth/login`, and every request 404s with nothing in\n * the config that looks wrong. This function resolves the path against the base\n * *path* instead, so the leading slash is a matter of taste rather than a\n * silent 404, and `baseURL` + `prefix` are interchangeable ways to say the same\n * thing.\n *\n * The prefix is applied at most once: a path that already opens with it — say\n * `\"/api/auth/login\"` under a `\"/api\"` prefix — is left alone, so a codebase\n * migrating to `prefix` can move its call sites one at a time. The check is per\n * segment, so `/api-keys` is not mistaken for an already-prefixed path.\n *\n * A path that is itself an absolute URL wins over all of this, which is how a\n * client reaches a second host (a signed upload endpoint, a CDN) without a\n * second client. Without `params` it is returned exactly as given: a signed\n * URL covers its query, and a round trip through `URL` re-encodes characters\n * outside the canonical form (`'` became `%27`, measured), which is a rewrite\n * of a string the server signed.\n *\n * @example\n * buildApiUrl(\"https://api.example.com\", \"/auth/login\", { prefix: \"/api\" });\n * // \"https://api.example.com/api/auth/login\"\n *\n * buildApiUrl(\"https://api.example.com/api\", \"auth/login\");\n * // \"https://api.example.com/api/auth/login\"\n *\n * @param baseURL - Absolute base URL, or a path relative to the current origin.\n * @param path - The request path, or an absolute URL to use as-is.\n * @param options - Optional prefix and query params.\n * @returns The absolute URL to fetch.\n * @throws When `baseURL` is relative and there is no `location` to resolve it.\n */\nexport function buildApiUrl(\n    baseURL: string,\n    path: string,\n    options: BuildApiUrlOptions = {},\n): string {\n    const { prefix, params } = options;\n    if (ABSOLUTE_URL.test(path) && !Object.values(params ?? {}).some((value) => value != null)) {\n        return path;\n    }\n    const url = ABSOLUTE_URL.test(path) ? new URL(path) : new URL(resolve(baseURL, path, prefix));\n\n    if (params) {\n        for (const [key, value] of Object.entries(params)) {\n            if (value !== undefined && value !== null) {\n                url.searchParams.set(key, String(value));\n            }\n        }\n    }\n    return url.toString();\n}\n\n/**\n * Build the absolute URL string for a path that is not already absolute.\n *\n * Kept separate from {@link buildApiUrl} so the query-param loop is not nested\n * inside the joining rules.\n *\n * @param baseURL - Absolute base URL, or a path relative to the current origin.\n * @param path - The request path.\n * @param prefix - Optional segment every request is nested under.\n * @returns The joined absolute URL.\n */\nfunction resolve(baseURL: string, path: string, prefix?: string): string {\n    const base = ABSOLUTE_URL.test(baseURL)\n        ? new URL(baseURL)\n        : new URL(baseURL, currentOrigin(baseURL));\n\n    const queryStart = path.indexOf(\"?\");\n    const rawPath = queryStart === -1 ? path : path.slice(0, queryStart);\n    const query = queryStart === -1 ? \"\" : path.slice(queryStart);\n\n    const basePath = [...segments(base.pathname), ...segments(prefix ?? \"\")];\n    const requested = segments(rawPath);\n    const joined = startsWithSegments(requested, basePath)\n        ? requested\n        : [...basePath, ...requested];\n\n    const trailing = rawPath.endsWith(\"/\") ? \"/\" : \"\";\n    const pathname = joined.length > 0 ? `/${joined.join(\"/\")}${trailing}` : \"/\";\n    return `${base.origin}${pathname}${query}`;\n}\n"],"mappings":"AAIA,IAAMA,EAAe,uBAGrB,SAASC,EAAS,EAAwB,CACtC,OAAOC,EAAK,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO,CACzC,CAYA,SAASC,EAAmB,EAAgB,EAA2B,CAEnE,OADIC,EAAO,SAAW,GAAKA,EAAO,OAASF,EAAK,OAAe,GACxDE,EAAO,OAAO,EAAS,IAAUF,EAAKG,KAAWC,CAAO,CACnE,CAcA,SAASC,EAAc,EAAyB,CAC5C,IAAMC,EAAS,WAAW,UAAU,OACpC,GAAI,CAACA,EACD,MAAU,UACN,6BAA6BC,EAAQ,kIACzC,EAEJ,OAAOD,CACX,CAmDA,SAAgBE,EACZ,EACA,EACA,EAA8B,CAAC,EACzB,CACN,GAAM,CAAE,SAAQ,UAAWC,EAC3B,GAAIX,EAAa,KAAKE,CAAI,GAAK,CAAC,OAAO,OAAOU,GAAU,CAAC,CAAC,CAAC,CAAC,KAAM,GAAUC,GAAS,IAAI,EACrF,OAAOX,EAEX,IAAMY,EAAMd,EAAa,KAAKE,CAAI,EAAI,IAAI,IAAIA,CAAI,EAAI,IAAI,IAAIa,EAAQN,EAASP,EAAME,CAAM,CAAC,EAE5F,GAAIQ,EACK,IAAA,GAAM,CAACI,EAAKH,KAAU,OAAO,QAAQD,CAAM,EACxCC,GAAiC,MACjCC,EAAI,aAAa,IAAIE,EAAK,OAAOH,CAAK,CAAC,EAInD,OAAOC,EAAI,SAAS,CACxB,CAaA,SAASC,EAAQ,EAAiB,EAAc,EAAyB,CACrE,IAAME,EAAOjB,EAAa,KAAKS,CAAO,EAChC,IAAI,IAAIA,CAAO,EACf,IAAI,IAAIA,EAASF,EAAcE,CAAO,CAAC,EAEvCS,EAAahB,EAAK,QAAQ,GAAG,EAC7BiB,EAAUD,IAAe,GAAKhB,EAAOA,EAAK,MAAM,EAAGgB,CAAU,EAC7DE,EAAQF,IAAe,GAAK,GAAKhB,EAAK,MAAMgB,CAAU,EAEtDG,EAAW,CAAC,GAAGpB,EAASgB,EAAK,QAAQ,EAAG,GAAGhB,EAASG,GAAU,EAAE,CAAC,EACjEkB,EAAYrB,EAASkB,CAAO,EAC5BI,EAASpB,EAAmBmB,EAAWD,CAAQ,EAC/CC,EACA,CAAC,GAAGD,EAAU,GAAGC,CAAS,EAE1BE,EAAWL,EAAQ,SAAS,GAAG,EAAI,IAAM,GACzCM,EAAWF,EAAO,OAAS,EAAI,IAAIA,EAAO,KAAK,GAAG,IAAIC,IAAa,IACzE,MAAO,GAAGP,EAAK,SAASQ,IAAWL,GACvC,C"}

package/dist/http/build-url.js

@@ -12,7 +12,9 @@ function r(e) {
 	return t;
 }
 function i(t, n, r = {}) {
-	let { prefix: i, params: o } = r, s = e.test(n) ? new URL(n) : new URL(a(t, n, i));
+	let { prefix: i, params: o } = r;
+	if (e.test(n) && !Object.values(o ?? {}).some((e) => e != null)) return n;
+	let s = e.test(n) ? new URL(n) : new URL(a(t, n, i));
 	if (o) for (let [e, t] of Object.entries(o)) t != null && s.searchParams.set(e, String(t));
 	return s.toString();
 }