universal-api-layer 0.7.0

package/dist/chunk-HDW7BOZI.js

@@ -0,0 +1,764 @@
+import {
+  abortable,
+  invokeCallback,
+  validateResponse
+} from "./chunk-DXYWZQW5.js";
+import {
+  ApiError
+} from "./chunk-YTM3FV65.js";
+
+// src/core/stream.ts
+async function* readStream(response, signal, assert, format, maxSize) {
+  assert();
+  const reader = response.body?.getReader();
+  if (!reader) {
+    if (response.status === 204 || response.status === 205) return;
+    throw new ApiError(
+      "Response has no readable body",
+      response.status,
+      {},
+      void 0,
+      "parse"
+    );
+  }
+  const cancel = () => {
+    void reader.cancel(signal.reason).catch(() => {
+    });
+  };
+  signal.addEventListener("abort", cancel, { once: true });
+  const decoder = new TextDecoder();
+  let line = "", skipLF = false, data = "", hasData = false, event = "", id = "";
+  let retry;
+  function tooLarge() {
+    throw new ApiError(
+      "SSE line or event exceeds maxEventSize",
+      response.status,
+      {},
+      void 0,
+      "parse"
+    );
+  }
+  function finishLine() {
+    const value = line;
+    line = "";
+    if (!value) {
+      const result = hasData ? Object.freeze({
+        event: event || "message",
+        data: data.slice(0, -1),
+        id,
+        ...retry === void 0 ? {} : { retry }
+      }) : void 0;
+      data = "";
+      hasData = false;
+      event = "";
+      return result;
+    }
+    const colon = value.indexOf(":");
+    const field = colon < 0 ? value : value.slice(0, colon);
+    let content = colon < 0 ? "" : value.slice(colon + 1);
+    if (content.startsWith(" ")) content = content.slice(1);
+    if (field === "data") {
+      if (data.length + content.length + 1 > maxSize) tooLarge();
+      data += content + "\n";
+      hasData = true;
+    } else if (field === "event") event = content;
+    else if (field === "id" && !content.includes("\0")) id = content;
+    else if (field === "retry" && /^\d+$/.test(content) && Number.isSafeInteger(Number(content)))
+      retry = Number(content);
+    return void 0;
+  }
+  try {
+    assert();
+    if (format === "sse" && response.headers.get("content-type")?.split(";", 1)[0].trim().toLowerCase() !== "text/event-stream")
+      throw new ApiError(
+        "Expected text/event-stream response",
+        response.status,
+        {},
+        void 0,
+        "parse"
+      );
+    while (true) {
+      const part = await abortable(() => reader.read(), signal);
+      assert();
+      const text = part.done ? decoder.decode() : decoder.decode(part.value, { stream: true });
+      if (format === "text") {
+        if (text) {
+          assert();
+          yield text;
+          assert();
+        }
+      } else {
+        for (const character of text) {
+          assert();
+          if (skipLF) {
+            skipLF = false;
+            if (character === "\n") continue;
+          }
+          if (character === "\r" || character === "\n") {
+            skipLF = character === "\r";
+            const message = finishLine();
+            if (message) {
+              assert();
+              yield message;
+            }
+          } else {
+            if (line.length + character.length > maxSize) tooLarge();
+            line += character;
+          }
+        }
+      }
+      if (part.done) break;
+    }
+  } finally {
+    signal.removeEventListener("abort", cancel);
+    void reader.cancel().catch(() => {
+    });
+    reader.releaseLock();
+  }
+}
+
+// src/core/session.ts
+function createSessionState(initial) {
+  let token = null;
+  let snapshot = Object.freeze({
+    userId: null,
+    tenantId: null,
+    revision: 0
+  });
+  let tokenVersion = 0;
+  const requests = /* @__PURE__ */ new Set();
+  const listeners = /* @__PURE__ */ new Set();
+  function validate(value) {
+    if (value !== null && (typeof value !== "object" || typeof value.userId !== "string" || !value.userId.trim() || value.tenantId != null && typeof value.tenantId !== "string" || value.token != null && (typeof value.token !== "string" || !value.token.trim())))
+      throw new ApiError(
+        "Session requires a non-empty userId and valid token/tenantId",
+        0,
+        {},
+        void 0,
+        "configuration"
+      );
+  }
+  if (initial !== void 0) validate(initial);
+  if (initial) {
+    validate(initial);
+    token = initial.token ?? null;
+    snapshot = Object.freeze({
+      userId: initial.userId,
+      tenantId: initial.tenantId ?? null,
+      revision: 0
+    });
+  }
+  const getSnapshot = () => snapshot;
+  const subscribe = (listener) => {
+    listeners.add(listener);
+    return () => {
+      listeners.delete(listener);
+    };
+  };
+  const assert = (revision) => {
+    if (revision !== snapshot.revision)
+      throw new ApiError(
+        "Authentication session changed",
+        0,
+        {},
+        void 0,
+        "cancelled"
+      );
+  };
+  function set(value, reason = new ApiError(
+    "Authentication session changed",
+    0,
+    {},
+    void 0,
+    "cancelled"
+  )) {
+    validate(value);
+    const userId = value?.userId ?? null, tenantId = value?.tenantId ?? null;
+    const changed = value === null || userId !== snapshot.userId || tenantId !== snapshot.tenantId;
+    if (token !== (value?.token ?? null)) tokenVersion++;
+    token = value?.token ?? null;
+    if (!changed) return;
+    snapshot = Object.freeze({
+      userId,
+      tenantId,
+      revision: snapshot.revision + 1
+    });
+    for (const controller of [...requests]) controller.abort(reason);
+    const errors = [];
+    for (const listener of [...listeners]) {
+      try {
+        listener();
+      } catch (error) {
+        errors.push(error);
+      }
+    }
+    if (errors.length)
+      throw new ApiError(
+        "Session subscriber failed",
+        0,
+        {},
+        void 0,
+        "callback",
+        new AggregateError(errors)
+      );
+  }
+  return {
+    getSnapshot,
+    validate,
+    subscribe,
+    assert,
+    set,
+    requests,
+    getToken: () => token,
+    getTokenVersion: () => tokenVersion,
+    updateToken(value, revision, version) {
+      assert(revision);
+      if (version === tokenVersion) {
+        token = value;
+        tokenVersion++;
+      }
+    }
+  };
+}
+
+// src/core/helpers.ts
+function laravelErrors(data) {
+  if (!data || typeof data !== "object" || !("errors" in data) || !data.errors || typeof data.errors !== "object")
+    return {};
+  return Object.fromEntries(
+    Object.entries(data.errors).map(([key, value]) => [
+      key,
+      Array.isArray(value) ? value.map(String) : [String(value)]
+    ])
+  );
+}
+function queryIdentity(client, key, url, params, headers, scope) {
+  return client.queryKey(key, url, params, headers, scope);
+}
+async function runMutation(client, config, variables) {
+  const revision = client.getSessionSnapshot().revision;
+  const url = invokeCallback(
+    () => typeof config.url === "function" ? config.url(variables) : config.url
+  );
+  const body = invokeCallback(
+    () => config.mapPayload ? config.mapPayload(variables) : variables
+  );
+  client.assertSession(revision);
+  const response = await client.request(url, {
+    method: config.method ?? "POST",
+    schema: config.schema,
+    requiresAuth: config.requiresAuth,
+    authRetry: config.authRetry,
+    body,
+    headers: config.headers,
+    signal: config.signal,
+    timeoutMs: config.timeoutMs
+  });
+  client.assertSession(revision);
+  const selected = config.select ? invokeCallback(() => config.select(response)) : response;
+  client.assertSession(revision);
+  return selected;
+}
+function defaultQueryRetry(failureCount, error) {
+  return failureCount < 3 && (error.code === "network" || error.code === "timeout" || error.code === "http" && error.status >= 500);
+}
+
+// src/core/client.ts
+var DEFAULT_TIMEOUT_MS = 15e3;
+var representationHeaders = [
+  "accept",
+  "accept-language",
+  "content-type"
+];
+function createApiClient(config = {}) {
+  const options = { ...config };
+  if (options.getToken && (options.session !== void 0 || options.refreshToken))
+    throw new ApiError(
+      "Use session/setSession instead of getToken with managed authentication or token refresh",
+      0,
+      {},
+      void 0,
+      "configuration"
+    );
+  let managedAuth = options.session !== void 0;
+  const session = createSessionState(options.session);
+  let refreshJob;
+  function setSession(value) {
+    session.validate(value);
+    managedAuth = true;
+    const oldVersion = session.getTokenVersion();
+    session.set(value);
+    if (refreshJob && (refreshJob.revision !== session.getSnapshot().revision || oldVersion !== session.getTokenVersion()))
+      refreshJob.controller.abort(
+        new ApiError(
+          "Session credentials changed",
+          0,
+          {},
+          void 0,
+          "cancelled"
+        )
+      );
+  }
+  const logout = () => setSession(null);
+  async function refresh(revision, version, signal) {
+    session.assert(revision);
+    if (session.getTokenVersion() !== version) return;
+    if (!refreshJob || refreshJob.revision !== revision || refreshJob.version !== version) {
+      const controller = new AbortController();
+      const timeout = options.refreshTimeoutMs ?? DEFAULT_TIMEOUT_MS;
+      if (!Number.isFinite(timeout) || timeout < 0)
+        throw new ApiError(
+          "refreshTimeoutMs must be finite and non-negative",
+          0,
+          {},
+          void 0,
+          "configuration"
+        );
+      const timer = timeout ? setTimeout(
+        () => controller.abort(
+          new ApiError(
+            "Token refresh timed out",
+            0,
+            {},
+            void 0,
+            "auth"
+          )
+        ),
+        timeout
+      ) : void 0;
+      const job = { revision, version, controller, promise: Promise.resolve() };
+      session.requests.add(controller);
+      job.promise = abortable(
+        () => options.refreshToken(controller.signal, session.getSnapshot()),
+        controller.signal
+      ).then((token) => {
+        session.assert(revision);
+        if (session.getTokenVersion() !== version) return;
+        if (typeof token !== "string" || !token.trim())
+          throw new ApiError(
+            "Refresh did not return an access token",
+            401,
+            {},
+            void 0,
+            "auth"
+          );
+        session.updateToken(token, revision, version);
+      }).catch((cause) => {
+        session.assert(revision);
+        if (session.getTokenVersion() !== version) return;
+        const error = new ApiError(
+          "Token refresh failed",
+          401,
+          {},
+          void 0,
+          "auth",
+          cause
+        );
+        session.set(null, error);
+        throw error;
+      }).finally(() => {
+        clearTimeout(timer);
+        session.requests.delete(controller);
+        if (refreshJob === job) refreshJob = void 0;
+      });
+      void job.promise.catch(() => {
+      });
+      refreshJob = job;
+    }
+    const pending = refreshJob.promise;
+    await abortable(() => pending, signal);
+  }
+  const defaultHeaders = new Headers(config.headers);
+  const cacheScope = config.cacheScope ?? globalThis.crypto.randomUUID?.() ?? Array.from(
+    globalThis.crypto.getRandomValues(new Uint8Array(16)),
+    (value) => value.toString(16).padStart(2, "0")
+  ).join("");
+  const baseUrl = config.baseUrl ?? "";
+  const browserOrigin = typeof location !== "undefined" && /^https?:$/.test(location.protocol) ? location.origin : void 0;
+  const parseUrl = (value, base) => {
+    const parsed = new URL(value, base);
+    if (!/^https?:$/.test(parsed.protocol) || parsed.username || parsed.password)
+      throw new ApiError(
+        "Only HTTP(S) URLs without embedded credentials are supported",
+        0,
+        {},
+        void 0,
+        "configuration"
+      );
+    return parsed;
+  };
+  if (/\\|^\/\//.test(baseUrl) || /^[a-z][a-z\d+.-]*:/i.test(baseUrl) && !/^https?:\/\//i.test(baseUrl))
+    throw new ApiError("Invalid baseUrl", 0, {}, void 0, "configuration");
+  const baseOrigin = /^https?:\/\//i.test(baseUrl) ? parseUrl(baseUrl).origin : browserOrigin;
+  const allowedOrigins = new Set(
+    (config.allowedOrigins ?? []).map((origin) => parseUrl(origin).origin)
+  );
+  if (baseOrigin) allowedOrigins.add(baseOrigin);
+  function targetUrl(url, params) {
+    if (/\\|^\/\//.test(url) || /^[a-z][a-z\d+.-]*:/i.test(url) && !/^https?:\/\//i.test(url))
+      throw new ApiError(
+        "Invalid request URL",
+        0,
+        {},
+        void 0,
+        "configuration"
+      );
+    let path = /^https?:\/\//i.test(url) ? url : `${baseUrl.replace(/\/$/, "")}/${url.replace(/^\//, "")}`;
+    if (/^https?:\/\//i.test(path)) {
+      const parsed = parseUrl(path);
+      if (!allowedOrigins.has(parsed.origin))
+        throw new ApiError(
+          "Request origin is not allowed. Add its exact origin to allowedOrigins to opt in to credential forwarding.",
+          0,
+          {},
+          void 0,
+          "configuration"
+        );
+      path = parsed.href;
+    }
+    const query = new URLSearchParams();
+    for (const [key, value] of Object.entries(params ?? {}))
+      if (value != null)
+        for (const item of Array.isArray(value) ? value : [value])
+          query.append(key, String(item));
+    const hashIndex = path.indexOf("#");
+    const beforeHash = hashIndex === -1 ? path : path.slice(0, hashIndex);
+    const hash = hashIndex === -1 ? "" : path.slice(hashIndex);
+    const encoded = query.toString();
+    return beforeHash + (encoded ? (beforeHash.includes("?") ? "&" : "?") + encoded : "") + hash;
+  }
+  function queryKey(key, url, params, headers, scope) {
+    const merged = new Headers(defaultHeaders);
+    new Headers(headers).forEach((value, name) => merged.set(name, value));
+    const vary = representationHeaders.flatMap(
+      (name) => merged.has(name) ? [[name, merged.get(name)]] : []
+    );
+    return [
+      ...key,
+      {
+        universalApiLayer: 1,
+        scope: cacheScope,
+        session: session.getSnapshot(),
+        account: scope,
+        url,
+        params,
+        headers: vary
+      }
+    ];
+  }
+  async function request(url, request2 = {}) {
+    for await (const context of transport(url, request2)) {
+      const { response, signal, assert } = context;
+      try {
+        const data = await readData(response, signal);
+        const schema = request2.schema === false ? void 0 : request2.schema ?? options.schema;
+        const validated = schema ? await abortable(
+          () => validateResponse(schema, data, response.status),
+          signal
+        ) : data;
+        assert();
+        if (request2.responseMode === "full")
+          return Object.freeze({
+            data: validated,
+            headers: new Headers(response.headers),
+            status: response.status,
+            statusText: response.statusText,
+            url: response.url
+          });
+        return validated;
+      } catch (cause) {
+        throw requestError(cause, signal);
+      }
+    }
+    throw new ApiError("Missing response", 0, {}, void 0, "network");
+  }
+  function requestError(cause, signal) {
+    if (signal.aborted) return signal.reason;
+    if (cause instanceof ApiError) return cause;
+    return new ApiError(
+      "Network request failed",
+      0,
+      {},
+      void 0,
+      "network",
+      cause
+    );
+  }
+  async function readData(response, signal) {
+    const raw = await abortable(() => response.text(), signal);
+    let data = raw === "" ? null : raw;
+    if (raw && response.headers.get("content-type")?.toLowerCase().includes("json")) {
+      try {
+        data = JSON.parse(raw);
+      } catch (cause) {
+        if (response.ok)
+          throw new ApiError(
+            "Invalid JSON response",
+            response.status,
+            {},
+            void 0,
+            "parse",
+            cause
+          );
+      }
+    }
+    return data;
+  }
+  async function* stream(url, request2 = {}) {
+    if (request2.format !== void 0 && request2.format !== "text" && request2.format !== "sse")
+      throw new ApiError(
+        "Stream format must be text or sse",
+        0,
+        {},
+        void 0,
+        "configuration"
+      );
+    const maxEventSize = request2.maxEventSize ?? 1048576;
+    if (!Number.isSafeInteger(maxEventSize) || maxEventSize <= 0)
+      throw new ApiError(
+        "maxEventSize must be a positive safe integer",
+        0,
+        {},
+        void 0,
+        "configuration"
+      );
+    const headers = new Headers(request2.headers);
+    if (request2.format === "sse" && !headers.has("Accept"))
+      headers.set("Accept", "text/event-stream");
+    for await (const { response, signal, assert } of transport(
+      url,
+      { ...request2, headers },
+      true
+    )) {
+      try {
+        yield* readStream(
+          response,
+          signal,
+          assert,
+          request2.format ?? "text",
+          maxEventSize
+        );
+      } catch (cause) {
+        throw requestError(cause, signal);
+      }
+    }
+  }
+  async function* transport(url, request2 = {}, streaming = false) {
+    if (request2.responseMode !== void 0 && request2.responseMode !== "data" && request2.responseMode !== "full")
+      throw new ApiError(
+        "responseMode must be data or full",
+        0,
+        {},
+        void 0,
+        "configuration"
+      );
+    const timeout = request2.timeoutMs ?? options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const revision = session.getSnapshot().revision;
+    if (request2.requiresAuth && !session.getSnapshot().userId)
+      throw new ApiError(
+        "An authenticated session is required",
+        401,
+        {},
+        void 0,
+        "auth"
+      );
+    if (timeout !== void 0 && (!Number.isFinite(timeout) || timeout < 0))
+      throw new ApiError(
+        "timeoutMs must be a finite non-negative number",
+        0,
+        {},
+        void 0,
+        "configuration"
+      );
+    let target;
+    try {
+      target = targetUrl(url, request2.params);
+    } catch (cause) {
+      if (cause instanceof ApiError) throw cause;
+      throw new ApiError(
+        "Invalid request configuration",
+        0,
+        {},
+        void 0,
+        "configuration",
+        cause
+      );
+    }
+    const controller = new AbortController();
+    session.requests.add(controller);
+    const abort = () => controller.abort(
+      new ApiError(
+        "Request cancelled",
+        0,
+        {},
+        void 0,
+        "cancelled",
+        request2.signal?.reason
+      )
+    );
+    if (request2.signal?.aborted) abort();
+    else request2.signal?.addEventListener("abort", abort, { once: true });
+    const timer = timeout ? setTimeout(
+      () => controller.abort(
+        new ApiError("Request timed out", 0, {}, void 0, "timeout")
+      ),
+      timeout
+    ) : void 0;
+    const cleanup = () => {
+      clearTimeout(timer);
+      session.requests.delete(controller);
+      request2.signal?.removeEventListener("abort", abort);
+      controller.signal.removeEventListener("abort", cleanup);
+    };
+    controller.signal.addEventListener("abort", cleanup, { once: true });
+    try {
+      controller.signal.throwIfAborted();
+      const headers = new Headers(defaultHeaders);
+      new Headers(request2.headers).forEach(
+        (value, name) => headers.set(name, value)
+      );
+      let token;
+      try {
+        token = await abortable(
+          () => managedAuth ? session.getToken() : options.getToken?.(controller.signal),
+          controller.signal
+        );
+      } catch (cause) {
+        if (controller.signal.aborted) throw controller.signal.reason;
+        throw new ApiError(
+          "Authentication token lookup failed",
+          0,
+          {},
+          void 0,
+          "auth",
+          cause
+        );
+      }
+      if (token) headers.set("Authorization", `Bearer ${token}`);
+      let body;
+      if (request2.body !== void 0) {
+        if (typeof request2.body === "string" || request2.body instanceof FormData || request2.body instanceof Blob || request2.body instanceof URLSearchParams || request2.body instanceof ArrayBuffer || ArrayBuffer.isView(request2.body))
+          body = request2.body;
+        else {
+          body = invokeCallback(() => JSON.stringify(request2.body));
+          if (!headers.has("Content-Type"))
+            headers.set("Content-Type", "application/json");
+        }
+      }
+      const send = async () => {
+        session.assert(revision);
+        if (managedAuth) {
+          headers.delete("Authorization");
+          const currentToken = session.getToken();
+          if (currentToken)
+            headers.set("Authorization", `Bearer ${currentToken}`);
+        }
+        const version2 = session.getTokenVersion();
+        const response2 = await abortable(
+          () => (options.fetch ?? globalThis.fetch)(target, {
+            method: request2.method ?? "GET",
+            headers,
+            body,
+            signal: controller.signal,
+            credentials: options.credentials,
+            redirect: "error",
+            cache: streaming || managedAuth || headers.has("Authorization") ? "no-store" : "default"
+          }),
+          controller.signal
+        );
+        session.assert(revision);
+        return { response: response2, version: version2 };
+      };
+      const pendingRefresh = refreshJob?.revision === revision ? refreshJob.promise : void 0;
+      if (request2.authRetry !== false && pendingRefresh)
+        await abortable(() => pendingRefresh, controller.signal);
+      let { response, version } = await send();
+      if (response.status === 401 && request2.authRetry !== false && options.refreshToken && session.getSnapshot().userId) {
+        void response.body?.cancel().catch(() => {
+        });
+        await refresh(revision, version, controller.signal);
+        ({ response, version } = await send());
+        if (response.status === 401) {
+          const error = new ApiError(
+            "Refreshed credentials were rejected",
+            401,
+            {},
+            void 0,
+            "auth"
+          );
+          session.set(null, error);
+          throw error;
+        }
+      }
+      if (!response.ok) {
+        const data = await readData(response, controller.signal);
+        throw new ApiError(
+          typeof data === "object" && data && "message" in data ? String(data.message) : response.statusText || "Request failed",
+          response.status,
+          invokeCallback(
+            () => (options.normalizeErrors ?? laravelErrors)(data)
+          ),
+          data
+        );
+      }
+      yield {
+        response,
+        signal: controller.signal,
+        assert: () => {
+          controller.signal.throwIfAborted();
+          session.assert(revision);
+        }
+      };
+    } catch (cause) {
+      if (controller.signal.aborted) throw controller.signal.reason;
+      if (cause instanceof ApiError) throw cause;
+      throw new ApiError(
+        "Network request failed",
+        0,
+        {},
+        void 0,
+        "network",
+        cause
+      );
+    } finally {
+      controller.abort(
+        new ApiError("Request closed", 0, {}, void 0, "cancelled")
+      );
+      cleanup();
+    }
+  }
+  return Object.freeze({
+    cacheScope,
+    queryKey,
+    setSession,
+    logout,
+    getSessionSnapshot: session.getSnapshot,
+    subscribeSession: session.subscribe,
+    assertSession: session.assert,
+    async withSession(operation, revision = session.getSnapshot().revision) {
+      session.assert(revision);
+      const controller = new AbortController();
+      session.requests.add(controller);
+      try {
+        return await abortable(operation, controller.signal);
+      } finally {
+        session.requests.delete(controller);
+      }
+    },
+    ownsQuery(key) {
+      const value = key.at(-1);
+      return !!value && typeof value === "object" && "universalApiLayer" in value && value.universalApiLayer === 1 && "scope" in value && value.scope === cacheScope;
+    },
+    request,
+    stream
+  });
+}
+
+export {
+  laravelErrors,
+  queryIdentity,
+  runMutation,
+  defaultQueryRetry,
+  DEFAULT_TIMEOUT_MS,
+  createApiClient
+};