@allisall/sdk 0.0.0-stage → 0.2.0

package/dist/retry.js

@@ -0,0 +1,105 @@
+// The retry decision and the wait between attempts.
+/** The longest `Retry-After` the SDK honours. A longer one ends the call. */
+export const MAX_RETRY_AFTER_MS = 60_000;
+const INITIAL_BACKOFF_MS = 500;
+const MAX_BACKOFF_MS = 8_000;
+/** The statuses worth repeating: a proxy's `408`, `429`, `500`, and a gateway's `502`, `503`, `504`. */
+export function isRetryableStatus(status) {
+    return (status === 408 ||
+        status === 429 ||
+        status === 500 ||
+        status === 502 ||
+        status === 503 ||
+        status === 504);
+}
+/**
+ * The wait before retry `n` (1 for the first retry) when the response
+ * carried no usable `Retry-After`: `min(0.5 s × 2^(n−1), 8 s)`, multiplied
+ * by a random factor between 0.75 and 1.
+ */
+export function backoffMs(retry) {
+    const base = Math.min(INITIAL_BACKOFF_MS * 2 ** (retry - 1), MAX_BACKOFF_MS);
+    return base * (1 - Math.random() * 0.25);
+}
+const MONTHS = [
+    "Jan",
+    "Feb",
+    "Mar",
+    "Apr",
+    "May",
+    "Jun",
+    "Jul",
+    "Aug",
+    "Sep",
+    "Oct",
+    "Nov",
+    "Dec",
+];
+// RFC 9110 §5.6.7: IMF-fixdate, and the two obsolete forms a recipient must accept.
+const IMF_FIXDATE = /^(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun), (\d{2}) ([A-Z][a-z]{2}) (\d{4}) (\d{2}):(\d{2}):(\d{2}) GMT$/;
+const RFC850_DATE = /^(?:Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday), (\d{2})-([A-Z][a-z]{2})-(\d{2}) (\d{2}):(\d{2}):(\d{2}) GMT$/;
+const ASCTIME_DATE = /^(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun) ([A-Z][a-z]{2}) ([ \d]\d) (\d{2}):(\d{2}):(\d{2}) (\d{4})$/;
+function utc(year, month, day, hour, minute, second) {
+    const m = MONTHS.indexOf(month);
+    if (m < 0)
+        return undefined;
+    const ms = Date.UTC(year, m, Number(day.trim()), Number(hour), Number(minute), Number(second));
+    return Number.isNaN(ms) ? undefined : ms;
+}
+function parseHttpDate(value, now) {
+    let match = IMF_FIXDATE.exec(value);
+    if (match !== null) {
+        const [, day = "", month = "", year = "", h = "", m = "", s = ""] = match;
+        return utc(Number(year), month, day, h, m, s);
+    }
+    match = RFC850_DATE.exec(value);
+    if (match !== null) {
+        const [, day = "", month = "", yy = "", h = "", m = "", s = ""] = match;
+        // RFC 9110 §5.6.7: a two-digit year more than 50 years in the future is in the past century.
+        const thisYear = new Date(now).getUTCFullYear();
+        let year = 2000 + Number(yy);
+        if (year > thisYear + 50)
+            year -= 100;
+        return utc(year, month, day, h, m, s);
+    }
+    match = ASCTIME_DATE.exec(value);
+    if (match !== null) {
+        const [, month = "", day = "", h = "", m = "", s = "", year = ""] = match;
+        return utc(Number(year), month, day, h, m, s);
+    }
+    return undefined;
+}
+/**
+ * Parses a `Retry-After` value, delay-seconds or an HTTP-date (RFC 9110
+ * §10.2.3), into milliseconds from `now`. Returns `undefined` for a value
+ * that does not parse or names a time in the past.
+ */
+export function parseRetryAfter(value, now) {
+    if (value === null)
+        return undefined;
+    const text = value.trim();
+    if (/^\d+$/.test(text))
+        return Number(text) * 1000;
+    const at = parseHttpDate(text, now);
+    if (at === undefined || at < now)
+        return undefined;
+    return at - now;
+}
+/** Waits `ms` milliseconds, or rejects with the signal's reason when it aborts first. */
+export function sleep(ms, signal) {
+    return new Promise((resolve, reject) => {
+        if (signal?.aborted) {
+            reject(signal.reason);
+            return;
+        }
+        const onAbort = () => {
+            clearTimeout(timer);
+            reject(signal?.reason);
+        };
+        const timer = setTimeout(() => {
+            signal?.removeEventListener("abort", onAbort);
+            resolve();
+        }, ms);
+        signal?.addEventListener("abort", onAbort, { once: true });
+    });
+}

package/dist/runtime.d.ts

@@ -0,0 +1,19 @@
+/** Reads a global by name, so a runtime without it is never touched. */
+export declare function globalValue(name: string): unknown;
+/**
+ * Reports whether the SDK runs in a browser: a window, where `document`
+ * is defined, or a Web Worker, where `globalThis` is an instance of
+ * `WorkerGlobalScope`. Node, Deno, Bun and edge runtimes define neither.
+ */
+export declare function isBrowser(): boolean;
+/**
+ * Reads an environment variable from `globalThis.process.env`, where it
+ * exists. Returns `undefined` for a variable that is unset or empty.
+ */
+export declare function readEnv(name: string): string | undefined;
+/**
+ * The `User-Agent` to send: `allisall-ts/<version> node/<node version>`.
+ * A server runtime that reports no Node version, such as an edge runtime,
+ * sends `allisall-ts/<version>` alone. A browser sends none.
+ */
+export declare function userAgent(): string | undefined;

package/dist/runtime.js

@@ -0,0 +1,61 @@
+// What the SDK learns about the runtime it runs in: whether it is a
+// browser, the environment, and the User-Agent. Globals are read through
+// `globalThis` by name, so a runtime without them, such as a browser
+// without `process`, is never touched.
+import { VERSION } from "./version.js";
+/** Reads a global by name, so a runtime without it is never touched. */
+export function globalValue(name) {
+    const value = Reflect.get(globalThis, name);
+    return value;
+}
+function isObject(value) {
+    return typeof value === "object" && value !== null;
+}
+/**
+ * Reports whether the SDK runs in a browser: a window, where `document`
+ * is defined, or a Web Worker, where `globalThis` is an instance of
+ * `WorkerGlobalScope`. Node, Deno, Bun and edge runtimes define neither.
+ */
+export function isBrowser() {
+    if (globalValue("document") !== undefined)
+        return true;
+    const scope = globalValue("WorkerGlobalScope");
+    return typeof scope === "function" && globalThis instanceof scope;
+}
+/**
+ * Reads an environment variable from `globalThis.process.env`, where it
+ * exists. Returns `undefined` for a variable that is unset or empty.
+ */
+export function readEnv(name) {
+    const process = globalValue("process");
+    if (!isObject(process))
+        return undefined;
+    const env = Reflect.get(process, "env");
+    if (!isObject(env))
+        return undefined;
+    const value = Reflect.get(env, name);
+    return typeof value === "string" && value !== "" ? value : undefined;
+}
+function nodeVersion() {
+    const process = globalValue("process");
+    if (!isObject(process))
+        return undefined;
+    const versions = Reflect.get(process, "versions");
+    if (!isObject(versions))
+        return undefined;
+    const node = Reflect.get(versions, "node");
+    return typeof node === "string" && node !== "" ? node : undefined;
+}
+/**
+ * The `User-Agent` to send: `allisall-ts/<version> node/<node version>`.
+ * A server runtime that reports no Node version, such as an edge runtime,
+ * sends `allisall-ts/<version>` alone. A browser sends none.
+ */
+export function userAgent() {
+    if (isBrowser())
+        return undefined;
+    const node = nodeVersion();
+    return node === undefined
+        ? `allisall-ts/${VERSION}`
+        : `allisall-ts/${VERSION} node/${node}`;
+}

package/dist/share.d.ts

@@ -0,0 +1,52 @@
+import { type FetchLike } from "./transport.js";
+import type { PublicReport } from "./types.js";
+/** The options of `getSharedReport`. Every one is optional. */
+export interface SharedReportOptions {
+    /**
+     * The API's base URL, absolute, `http` or `https`. Defaults to
+     * `AIA_BASE_URL` from the environment, then `https://api.allisai.ai`.
+     * In a browser it may also be a path on the page's own origin, starting
+     * with a single `/`.
+     */
+    baseURL?: string | undefined;
+    /** The timeout of each attempt, in milliseconds. Defaults to 60,000. */
+    timeout?: number | undefined;
+    /** How many times a failure worth repeating is retried. Defaults to 2; 0 turns retries off. */
+    maxRetries?: number | undefined;
+    /** The `fetch` to send the request with. Defaults to the platform's own. */
+    fetch?: FetchLike | undefined;
+    /** Cancels the call, including any wait between retries. */
+    signal?: AbortSignal | undefined;
+    /**
+     * Extra headers to send. They may not name `Authorization`,
+     * `Content-Type`, `Idempotency-Key` or `X-Request-Id`, which the SDK sets.
+     */
+    headers?: Readonly<Record<string, string>> | undefined;
+}
+/**
+ * Reads a shared report with its share token, as the report's recipient
+ * sees it. Needs no API key and no session, and never reads `AIA_API_KEY`.
+ *
+ * A share token is a bearer capability: anyone holding it can read the
+ * report. Handle it like a secret, and keep it out of URLs and logs. The
+ * SDK sends it only in the `Authorization` header, as
+ * `Authorization: Report <token>`, and keeps it for this call alone.
+ *
+ * Every failure, a missing, unknown or revoked token included, is the same
+ * `404`, as an `ApiError`. Each read stamps the report's view times, and a
+ * retry after a lost response stamps them again.
+ *
+ * Operation `getSharedReport`.
+ *
+ * @param shareToken - the report's share token.
+ * @throws {AllisallError} when the share token is empty or holds a
+ * character other than printable ASCII, or an option is one a client would
+ * refuse, before anything is sent.
+ * @throws {TypeError} when `options.headers` is not a plain object of
+ * header names and string values, or names a header the SDK sets, before
+ * anything is sent.
+ * @throws {ApiError} for an error response, such as the `404` for a token
+ * that reads no report.
+ * @throws {ConnectionError} when no response arrived, after any retries.
+ */
+export declare function getSharedReport(shareToken: string, options?: SharedReportOptions): Promise<PublicReport>;

package/dist/share.js

@@ -0,0 +1,60 @@
+// Reading a shared report with its share token. It is a function, not a
+// client method: its caller, such as a server rendering the report's page,
+// holds no API key and no session, which a client requires.
+import { transportSettings } from "./client.js";
+import { AllisallError } from "./errors.js";
+import { request } from "./request.js";
+import { isBrowser } from "./runtime.js";
+import { isPrintableCredential, } from "./transport.js";
+/** Trims a share token and checks it can travel in a header. */
+function checkedShareToken(shareToken) {
+    const token = typeof shareToken === "string" ? shareToken.trim() : "";
+    if (token === "") {
+        throw new AllisallError("allisall: the share token is empty");
+    }
+    if (!isPrintableCredential(token)) {
+        throw new AllisallError("allisall: the share token holds a character other than printable ASCII, which cannot be sent");
+    }
+    return token;
+}
+/**
+ * Reads a shared report with its share token, as the report's recipient
+ * sees it. Needs no API key and no session, and never reads `AIA_API_KEY`.
+ *
+ * A share token is a bearer capability: anyone holding it can read the
+ * report. Handle it like a secret, and keep it out of URLs and logs. The
+ * SDK sends it only in the `Authorization` header, as
+ * `Authorization: Report <token>`, and keeps it for this call alone.
+ *
+ * Every failure, a missing, unknown or revoked token included, is the same
+ * `404`, as an `ApiError`. Each read stamps the report's view times, and a
+ * retry after a lost response stamps them again.
+ *
+ * Operation `getSharedReport`.
+ *
+ * @param shareToken - the report's share token.
+ * @throws {AllisallError} when the share token is empty or holds a
+ * character other than printable ASCII, or an option is one a client would
+ * refuse, before anything is sent.
+ * @throws {TypeError} when `options.headers` is not a plain object of
+ * header names and string values, or names a header the SDK sets, before
+ * anything is sent.
+ * @throws {ApiError} for an error response, such as the `404` for a token
+ * that reads no report.
+ * @throws {ConnectionError} when no response arrived, after any retries.
+ */
+export async function getSharedReport(shareToken, options = {}) {
+    const token = checkedShareToken(shareToken);
+    const config = {
+        ...transportSettings(options, isBrowser()),
+        // The share token is the call's only credential, and it is not an API
+        // key, so no browser opt-in applies. No client sends default headers.
+        credential: undefined,
+        refuseApiKeys: false,
+        defaultHeaders: {},
+    };
+    return request(config, "getSharedReport", {
+        shareToken: token,
+        options: { signal: options.signal, headers: options.headers },
+    });
+}

package/dist/transport.d.ts

@@ -0,0 +1,102 @@
+import type { Problem } from "./types.js";
+/** A `fetch`-compatible function. */
+export type FetchLike = (url: string, init: RequestInit) => Promise<Response>;
+/** A callback returning the bearer token to send, called before every attempt. */
+export type TokenProvider = () => string | Promise<string>;
+/** Where the bearer token comes from. */
+export type Credential = {
+    readonly kind: "apiKey";
+    readonly apiKey: string;
+} | {
+    readonly kind: "provider";
+    readonly provider: TokenProvider;
+};
+/** Everything an attempt needs, fixed when the client is constructed. */
+export interface TransportConfig {
+    readonly baseURL: URL;
+    /**
+     * The client's credential. Absent for a shared report, whose call carries
+     * its own share token and sends no client credential.
+     */
+    readonly credential: Credential | undefined;
+    readonly timeout: number;
+    readonly maxRetries: number;
+    readonly fetch: FetchLike | undefined;
+    /** Whether a token that is an API key is refused: a browser without the opt-in. */
+    readonly refuseApiKeys: boolean;
+    /** The `User-Agent` to send; `undefined` in a browser. */
+    readonly userAgent: string | undefined;
+    /** Headers sent on every request, already checked. */
+    readonly defaultHeaders: Readonly<Record<string, string>>;
+}
+/** The message of the error refusing an API key in a browser. */
+export declare const BROWSER_KEY_MESSAGE: string;
+/** Reports whether a bearer token is an API key, which starts `aia_`. */
+export declare function isApiKey(token: string): boolean;
+/** Joins the base URL and an operation's path with exactly one `/`. */
+export declare function joinURL(base: URL, path: string): string;
+/**
+ * Reports whether every character of a credential, already trimmed, is
+ * printable ASCII (U+0021 to U+007E), as a bearer credential is. Anything
+ * else, a control character, an inner space or a non-ASCII character,
+ * cannot travel in the header. The check never quotes the credential, so
+ * no error built from it can leak the secret.
+ */
+export declare function isPrintableCredential(credential: string): boolean;
+/**
+ * Reads an `application/problem+json` body as a problem document. Returns
+ * `undefined` for any other body, or one that is not a JSON object. A
+ * member of the wrong type is left out on its own, as is a malformed
+ * entry of `errors`; the rest of the problem is kept. Members the SDK does
+ * not know are ignored.
+ */
+export declare function readProblem(contentType: string | null, text: string): Problem | undefined;
+/**
+ * How a successful body is read. `undefined` means the body was not the
+ * expected shape, which is an `ApiError` carrying the status.
+ */
+export type ReadBody<T> = (text: string) => {
+    readonly value: T;
+} | undefined;
+/**
+ * The `Authorization` a request sends: the client's credential as a bearer,
+ * none, or a share token under the `Report` scheme.
+ */
+export type Authorization = "bearer" | "none" | {
+    readonly report: string;
+};
+/** One request, fixed before the first attempt and sent unchanged on each. */
+export interface Outgoing {
+    readonly method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+    readonly url: string;
+    readonly authorization: Authorization;
+    /** The body: bytes, or a form whose boundary `fetch` writes. */
+    readonly body: Uint8Array | FormData | undefined;
+    /** The body's `Content-Type`; `undefined` for no body, or a form. */
+    readonly contentType: string | undefined;
+    /** The `Idempotency-Key` sent on every attempt, if any. */
+    readonly idempotencyKey: string | undefined;
+}
+/** What one call may do, from its operation and its options. */
+export interface CallPolicy {
+    readonly timeout: number;
+    readonly maxRetries: number;
+    /** The call's headers, already checked. */
+    readonly headers: Readonly<Record<string, string>>;
+    readonly signal: AbortSignal | undefined;
+    /** Whether a retry cannot apply the request twice, so it may be retried at all. */
+    readonly eligible: boolean;
+    /** Whether a `409` `idempotency_key_in_use` is retried: the request carries a reused key. */
+    readonly retryKeyInUse: boolean;
+}
+/**
+ * Sends a request, retrying a failure worth repeating when the request is
+ * eligible. The body is the same on every attempt. Each attempt reads a
+ * fresh token and sends a fresh `X-Request-Id`.
+ */
+export declare function send<T>(config: TransportConfig, out: Outgoing, read: ReadBody<T>, policy: CallPolicy): Promise<T>;
+/**
+ * Posts a JSON body that a retry cannot apply twice, such as an ingest
+ * batch, retrying a failure worth repeating.
+ */
+export declare function post<T>(config: TransportConfig, path: string, body: Uint8Array, read: (body: unknown) => T | undefined, policy: Omit<CallPolicy, "eligible" | "retryKeyInUse">): Promise<T>;

package/dist/transport.js

@@ -0,0 +1,269 @@
+// One HTTP attempt (headers, timeout, reading the response) and the loop
+// that repeats it under the retry rules in retry.ts, for any method and
+// any body.
+import { AllisallError, ApiError, ConnectionError } from "./errors.js";
+import { mergeHeaders } from "./options.js";
+import { backoffMs, isRetryableStatus, MAX_RETRY_AFTER_MS, parseRetryAfter, sleep, } from "./retry.js";
+import { uuidv4 } from "./uuid.js";
+/** The message of the error refusing an API key in a browser. */
+export const BROWSER_KEY_MESSAGE = "allisall: refusing to use an API key in a browser, where it is readable by anyone who loads the page. " +
+    "Call the API from your server instead, or pass dangerouslyAllowBrowser: true if you accept that risk.";
+/** Reports whether a bearer token is an API key, which starts `aia_`. */
+export function isApiKey(token) {
+    return token.startsWith("aia_");
+}
+/** Joins the base URL and an operation's path with exactly one `/`. */
+export function joinURL(base, path) {
+    const url = new URL(base.href);
+    url.pathname = url.pathname.replace(/\/+$/, "") + path;
+    return url.href;
+}
+/**
+ * Reports whether every character of a credential, already trimmed, is
+ * printable ASCII (U+0021 to U+007E), as a bearer credential is. Anything
+ * else, a control character, an inner space or a non-ASCII character,
+ * cannot travel in the header. The check never quotes the credential, so
+ * no error built from it can leak the secret.
+ */
+export function isPrintableCredential(credential) {
+    for (let i = 0; i < credential.length; i++) {
+        const c = credential.charCodeAt(i);
+        if (c < 0x21 || c > 0x7e)
+            return false;
+    }
+    return true;
+}
+async function bearerToken(config) {
+    const { credential } = config;
+    if (credential === undefined) {
+        throw new AllisallError("allisall: this call has no client credential");
+    }
+    if (credential.kind === "apiKey")
+        return credential.apiKey;
+    const raw = await credential.provider();
+    const token = typeof raw === "string" ? raw.trim() : raw;
+    if (token === "") {
+        throw new AllisallError("allisall: the token provider returned an empty token");
+    }
+    if (typeof token === "string" && !isPrintableCredential(token)) {
+        throw new AllisallError("allisall: the token provider returned a token holding a character other than printable ASCII, which cannot be sent");
+    }
+    if (config.refuseApiKeys && typeof token === "string" && isApiKey(token)) {
+        throw new AllisallError(BROWSER_KEY_MESSAGE);
+    }
+    return token;
+}
+function isObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseJSON(text) {
+    try {
+        const value = JSON.parse(text);
+        return value;
+    }
+    catch {
+        return undefined;
+    }
+}
+const OPTIONAL_LOCATORS = [
+    "pointer",
+    "parameter",
+    "header",
+    "part",
+    "column",
+];
+function readFieldError(value) {
+    if (!isObject(value))
+        return undefined;
+    const { code, detail } = value;
+    if (typeof code !== "string" || typeof detail !== "string")
+        return undefined;
+    const out = { code, detail };
+    for (const name of OPTIONAL_LOCATORS) {
+        const locator = value[name];
+        if (typeof locator === "string")
+            out[name] = locator;
+    }
+    return out;
+}
+const PROBLEM_STRINGS = [
+    "type",
+    "title",
+    "detail",
+    "code",
+    "request_id",
+];
+/**
+ * Reads an `application/problem+json` body as a problem document. Returns
+ * `undefined` for any other body, or one that is not a JSON object. A
+ * member of the wrong type is left out on its own, as is a malformed
+ * entry of `errors`; the rest of the problem is kept. Members the SDK does
+ * not know are ignored.
+ */
+export function readProblem(contentType, text) {
+    const mediaType = contentType?.split(";")[0]?.trim().toLowerCase();
+    if (mediaType !== "application/problem+json")
+        return undefined;
+    const body = parseJSON(text);
+    if (!isObject(body))
+        return undefined;
+    const problem = {};
+    for (const name of PROBLEM_STRINGS) {
+        const value = body[name];
+        if (typeof value === "string")
+            problem[name] = value;
+    }
+    if (typeof body.status === "number")
+        problem.status = body.status;
+    if (Array.isArray(body.errors)) {
+        problem.errors = body.errors
+            .map(readFieldError)
+            .filter((e) => e !== undefined);
+    }
+    return problem;
+}
+function headerOrUndefined(headers, name) {
+    return headers.get(name) ?? undefined;
+}
+/**
+ * Sends one attempt. Resolves with the read `2xx` body; throws an
+ * `ApiError` for any other status or an unreadable `2xx` body, a
+ * `ConnectionError` when no response arrived, or the caller's abort reason.
+ */
+async function attempt(config, out, read, authorization, requestId, policy) {
+    const headers = {};
+    if (authorization !== undefined)
+        headers.Authorization = authorization;
+    if (out.contentType !== undefined)
+        headers["Content-Type"] = out.contentType;
+    headers["X-Request-Id"] = requestId;
+    if (config.userAgent !== undefined)
+        headers["User-Agent"] = config.userAgent;
+    if (out.idempotencyKey !== undefined) {
+        headers["Idempotency-Key"] = out.idempotencyKey;
+    }
+    mergeHeaders(headers, config.defaultHeaders);
+    mergeHeaders(headers, policy.headers);
+    const { signal } = policy;
+    const timeout = AbortSignal.timeout(policy.timeout);
+    const combined = signal === undefined ? timeout : AbortSignal.any([signal, timeout]);
+    const doFetch = config.fetch ?? globalThis.fetch;
+    const init = {
+        method: out.method,
+        headers,
+        ...(out.body === undefined ? {} : { body: out.body }),
+        signal: combined,
+        // A redirect is never followed, so Authorization never travels to
+        // another location.
+        redirect: "manual",
+    };
+    let response;
+    let text;
+    try {
+        response = await doFetch(out.url, init);
+        text = await response.text();
+    }
+    catch (err) {
+        if (signal?.aborted)
+            throw signal.reason;
+        throw new ConnectionError(requestId, err);
+    }
+    const status = response.status;
+    const responseId = headerOrUndefined(response.headers, "X-Request-Id");
+    // A 3xx, or a browser's opaque redirect, whose status is 0.
+    if ((status >= 300 && status < 400) || response.type === "opaqueredirect") {
+        throw new ApiError({
+            status,
+            headers: response.headers,
+            requestId: responseId,
+            message: `allisall: the API answered ${status} with a redirect, which the SDK does not follow`,
+        });
+    }
+    if (status >= 200 && status < 300) {
+        const result = read(text);
+        if (result !== undefined)
+            return result.value;
+        throw new ApiError({
+            status,
+            headers: response.headers,
+            requestId: responseId,
+            message: `allisall: the API answered ${status} with a body the SDK could not read`,
+        });
+    }
+    throw new ApiError({
+        status,
+        problem: readProblem(response.headers.get("Content-Type"), text),
+        requestId: responseId,
+        retryAfter: parseRetryAfter(response.headers.get("Retry-After"), Date.now()),
+        headers: response.headers,
+    });
+}
+function worthRepeating(err, policy) {
+    if (err instanceof ConnectionError)
+        return true;
+    if (isRetryableStatus(err.status))
+        return true;
+    // The first request with this key is still running; a later attempt can
+    // collect its outcome.
+    return (policy.retryKeyInUse &&
+        err.status === 409 &&
+        err.code === "idempotency_key_in_use");
+}
+/** The `Authorization` value of one attempt, reading a fresh bearer token. */
+async function authorizationOf(config, out) {
+    const { authorization } = out;
+    if (authorization === "none")
+        return undefined;
+    if (authorization === "bearer")
+        return `Bearer ${await bearerToken(config)}`;
+    return `Report ${authorization.report}`;
+}
+/**
+ * Sends a request, retrying a failure worth repeating when the request is
+ * eligible. The body is the same on every attempt. Each attempt reads a
+ * fresh token and sends a fresh `X-Request-Id`.
+ */
+export async function send(config, out, read, policy) {
+    const maxRetries = policy.eligible ? policy.maxRetries : 0;
+    for (let retry = 0;; retry++) {
+        // An error from the token provider ends the call unwrapped and unretried.
+        const authorization = await authorizationOf(config, out);
+        try {
+            return await attempt(config, out, read, authorization, uuidv4(), policy);
+        }
+        catch (err) {
+            if (!(err instanceof ApiError || err instanceof ConnectionError))
+                throw err;
+            if (!worthRepeating(err, policy) || retry >= maxRetries)
+                throw err;
+            let wait;
+            if (err instanceof ApiError && err.retryAfter !== undefined) {
+                if (err.retryAfter > MAX_RETRY_AFTER_MS)
+                    throw err;
+                wait = err.retryAfter;
+            }
+            else {
+                wait = backoffMs(retry + 1);
+            }
+            await sleep(wait, policy.signal);
+        }
+    }
+}
+/**
+ * Posts a JSON body that a retry cannot apply twice, such as an ingest
+ * batch, retrying a failure worth repeating.
+ */
+export function post(config, path, body, read, policy) {
+    return send(config, {
+        method: "POST",
+        url: joinURL(config.baseURL, path),
+        authorization: "bearer",
+        body,
+        contentType: "application/json",
+        idempotencyKey: undefined,
+    }, (text) => {
+        const parsed = parseJSON(text);
+        const value = parsed === undefined ? undefined : read(parsed);
+        return value === undefined ? undefined : { value };
+    }, { ...policy, eligible: true, retryKeyInUse: false });
+}