@doist/todoist-sdk 14.1.0 → 14.2.0

package/README.md

@@ -125,12 +125,57 @@ const refreshed = await refreshAuthToken({
 > refresh. For public clients (`tokenEndpointAuthMethod: 'none'`), omit
 > `clientSecret` when calling `refreshAuthToken`.
 
+### Keeping Proxy Support and Response Decompression
+
+On Node, the SDK's default transport reads the proxy environment variables (`HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY`) and decodes compressed response bodies. Supplying a `customFetch` replaces that transport, so a custom implementation that still wants both can borrow it with `getDefaultTransport`:
+
+```typescript
+import { type CustomFetch, getDefaultTransport, TodoistApi } from '@doist/todoist-sdk'
+
+const customFetch: CustomFetch = async (url, options) => {
+    const transport = await getDefaultTransport()
+    // undici's `fetch` and the global one are the same call at runtime but
+    // carry different types, so settle on one signature.
+    const fetchImpl = (transport?.fetch ?? fetch) as typeof fetch
+
+    const response = await fetchImpl(url, {
+        ...options,
+        headers: {
+            ...(options?.headers as Record<string, string> | undefined),
+            'x-my-header': 'value',
+        },
+        // `dispatcher` is a Node fetch option that the DOM types don't declare.
+        dispatcher: transport?.dispatcher,
+    } as RequestInit)
+
+    // `CustomFetchResponse` wants plain-object headers, not a `Headers`.
+    const headers: Record<string, string> = {}
+    response.headers.forEach((value, key) => {
+        headers[key] = value
+    })
+
+    return {
+        ok: response.ok,
+        status: response.status,
+        statusText: response.statusText,
+        headers,
+        text: () => response.text(),
+        json: () => response.json(),
+        arrayBuffer: () => response.arrayBuffer(),
+    }
+}
+
+const api = new TodoistApi('YOURTOKEN', { customFetch })
+```
+
+`getDefaultTransport` returns the dispatcher and the `fetch` it must be used with as a single value, and both halves have to be used together. The dispatcher decompresses the response body itself, so pairing it with a `fetch` from a different undici build — including the runtime's global `fetch` on Node 26 — decodes the body twice and the request fails mid-stream with `terminated`. A `fetch` of `undefined` means the global `fetch` is the correct partner; the whole value is `undefined` outside Node, where no dispatcher applies.
+
 ### Important Notes
 
 - All existing transforms (snake_case ↔ camelCase) work automatically with custom fetch
 - Retry logic and error handling are preserved
 - File uploads work with custom fetch implementations
-- The custom fetch function should handle FormData for multipart uploads
+- File upload bodies are a `Blob`, or a `ReadableStream` when uploading from a stream — a custom fetch must pass them through unchanged
 - Timeout parameter is optional and up to your custom implementation
 
 ## Development and Testing

package/dist/cjs/index.js

@@ -14,10 +14,11 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getDefaultDispatcher = void 0;
+exports.getDefaultTransport = exports.getDefaultDispatcher = void 0;
 __exportStar(require("./todoist-api"), exports);
 __exportStar(require("./authentication"), exports);
 __exportStar(require("./types"), exports);
 __exportStar(require("./utils"), exports);
 var http_dispatcher_1 = require("./transport/http-dispatcher");
 Object.defineProperty(exports, "getDefaultDispatcher", { enumerable: true, get: function () { return http_dispatcher_1.getDefaultDispatcher; } });
+Object.defineProperty(exports, "getDefaultTransport", { enumerable: true, get: function () { return http_dispatcher_1.getDefaultTransport; } });

package/dist/cjs/transport/http-dispatcher.js

@@ -50,6 +50,23 @@ let defaultTransportPromise;
  * The default dispatcher and its paired `fetch`, as a single value so the two
  * are always read consistently. Resolves to `undefined` outside Node (browser/
  * edge), where callers use the global `fetch` with no dispatcher.
+ *
+ * Use this when supplying a `customFetch` that should still honour the proxy
+ * environment variables (`HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY`) and decode
+ * compressed responses the way the SDK does by default.
+ *
+ * Both halves must be used together. `dispatcher` decompresses the response
+ * body itself, so a `fetch` from a different undici build will try to decode
+ * it a second time and the request fails mid-stream with `terminated`. A
+ * `fetch` of `undefined` means the runtime's global `fetch` is the correct
+ * partner for this dispatcher.
+ *
+ * @example
+ * ```ts
+ * const transport = await getDefaultTransport()
+ * const fetchImpl = transport?.fetch ?? fetch
+ * const response = await fetchImpl(url, { ...options, dispatcher: transport?.dispatcher })
+ * ```
  */
 function getDefaultTransport() {
     if (!isNodeEnvironment()) {
@@ -69,6 +86,14 @@ function getDefaultTransport() {
     }
     return defaultTransportPromise;
 }
+/**
+ * The default dispatcher on its own.
+ *
+ * @deprecated Use {@link getDefaultTransport} instead, which returns this
+ * dispatcher together with the `fetch` it must be used with. Attaching this
+ * dispatcher to the runtime's global `fetch` decodes compressed responses
+ * twice on Node 26 and the request fails with `terminated`.
+ */
 async function getDefaultDispatcher() {
     var _a;
     return (_a = (await getDefaultTransport())) === null || _a === void 0 ? void 0 : _a.dispatcher;

package/dist/cjs/utils/multipart-upload.js

@@ -32,8 +32,29 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
+var __await = (this && this.__await) || function (v) { return this instanceof __await ? (this.v = v, this) : new __await(v); }
+var __asyncValues = (this && this.__asyncValues) || function (o) {
+    if (!Symbol.asyncIterator) throw new TypeError("Symbol.asyncIterator is not defined.");
+    var m = o[Symbol.asyncIterator], i;
+    return m ? m.call(o) : (o = typeof __values === "function" ? __values(o) : o[Symbol.iterator](), i = {}, verb("next"), verb("throw"), verb("return"), i[Symbol.asyncIterator] = function () { return this; }, i);
+    function verb(n) { i[n] = o[n] && function (v) { return new Promise(function (resolve, reject) { v = o[n](v), settle(resolve, reject, v.done, v.value); }); }; }
+    function settle(resolve, reject, d, v) { Promise.resolve(v).then(function(v) { resolve({ value: v, done: d }); }, reject); }
+};
+var __asyncGenerator = (this && this.__asyncGenerator) || function (thisArg, _arguments, generator) {
+    if (!Symbol.asyncIterator) throw new TypeError("Symbol.asyncIterator is not defined.");
+    var g = generator.apply(thisArg, _arguments || []), i, q = [];
+    return i = Object.create((typeof AsyncIterator === "function" ? AsyncIterator : Object).prototype), verb("next"), verb("throw"), verb("return", awaitReturn), i[Symbol.asyncIterator] = function () { return this; }, i;
+    function awaitReturn(f) { return function (v) { return Promise.resolve(v).then(f, reject); }; }
+    function verb(n, f) { if (g[n]) { i[n] = function (v) { return new Promise(function (a, b) { q.push([n, v, a, b]) > 1 || resume(n, v); }); }; if (f) i[n] = f(i[n]); } }
+    function resume(n, v) { try { step(g[n](v)); } catch (e) { settle(q[0][3], e); } }
+    function step(r) { r.value instanceof __await ? Promise.resolve(r.value.v).then(fulfill, reject) : settle(q[0][2], r); }
+    function fulfill(value) { resume("next", value); }
+    function reject(value) { resume("throw", value); }
+    function settle(f, v) { if (f(v), q.shift(), q.length) resume(q[0][0], q[0][1]); }
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.uploadMultipartFile = uploadMultipartFile;
+const uuid_1 = require("uuid");
 const fetch_with_retry_1 = require("../transport/fetch-with-retry");
 const case_conversion_1 = require("./case-conversion");
 /**
@@ -59,6 +80,116 @@ function getContentTypeFromFileName(fileName) {
             return 'application/octet-stream';
     }
 }
+/**
+ * Escapes a value for use inside a quoted `Content-Disposition` parameter,
+ * where a raw quote would end the value early and a raw CR or LF would end the
+ * header. Note that a lone CR needs escaping too, not just CRLF pairs.
+ *
+ * This is the same escaping the platform's own `FormData` encoder applies, so
+ * servers see exactly what they would from any browser or from undici.
+ */
+function escapeDispositionValue(value) {
+    return value.replace(/"/g, '%22').replace(/\r/g, '%0D').replace(/\n/g, '%0A');
+}
+/**
+ * Lays out a `multipart/form-data` payload around a single file part, as the
+ * text that goes before and after the file content. Keeping the file content
+ * out of it lets the same layout serve both a `Blob` body and a streamed one.
+ */
+function layOutMultipart(args) {
+    const { fileName, fileContentType, additionalFields } = args;
+    const boundary = `----todoist-sdk-${(0, uuid_1.v4)()}`;
+    const head = `--${boundary}\r\n` +
+        `Content-Disposition: form-data; name="file"; filename="${escapeDispositionValue(fileName)}"\r\n` +
+        `Content-Type: ${fileContentType}\r\n\r\n`;
+    let tail = '\r\n';
+    for (const [key, value] of Object.entries(additionalFields)) {
+        if (value !== undefined && value !== null) {
+            tail +=
+                `--${boundary}\r\n` +
+                    `Content-Disposition: form-data; name="${escapeDispositionValue(key)}"\r\n\r\n` +
+                    `${value.toString()}\r\n`;
+        }
+    }
+    tail += `--${boundary}--\r\n`;
+    return { boundary, head, tail };
+}
+/**
+ * Wraps a Node readable stream as a `multipart/form-data` request body.
+ *
+ * The result is a web `ReadableStream`, which both the runtime's `fetch` and
+ * undici's own accept — unlike a Node stream or a `FormData`, either of which
+ * only works with one particular client. The file is never buffered, so the
+ * request is sent with `Transfer-Encoding: chunked`.
+ */
+function streamMultipartBody(file, parts) {
+    const encoder = new TextEncoder();
+    function chunks() {
+        return __asyncGenerator(this, arguments, function* chunks_1() {
+            var _a, e_1, _b, _c;
+            yield yield __await(encoder.encode(parts.head));
+            try {
+                for (var _d = true, file_1 = __asyncValues(file), file_1_1; file_1_1 = yield __await(file_1.next()), _a = file_1_1.done, !_a; _d = true) {
+                    _c = file_1_1.value;
+                    _d = false;
+                    const chunk = _c;
+                    yield yield __await(typeof chunk === 'string' ? encoder.encode(chunk) : new Uint8Array(chunk));
+                }
+            }
+            catch (e_1_1) { e_1 = { error: e_1_1 }; }
+            finally {
+                try {
+                    if (!_d && !_a && (_b = file_1.return)) yield __await(_b.call(file_1));
+                }
+                finally { if (e_1) throw e_1.error; }
+            }
+            yield yield __await(encoder.encode(parts.tail));
+        });
+    }
+    const iterator = chunks();
+    // Driven by hand rather than with `ReadableStream.from`, which is absent
+    // from this project's DOM lib types and is still missing in some browsers,
+    // or `Readable.toWeb`, which would drag a Node-only import into a module
+    // that browsers also load.
+    return new ReadableStream({
+        async pull(controller) {
+            const { value, done } = await iterator.next();
+            if (done) {
+                controller.close();
+                return;
+            }
+            controller.enqueue(value);
+        },
+        async cancel(reason) {
+            var _a;
+            await ((_a = iterator.return) === null || _a === void 0 ? void 0 : _a.call(iterator, reason));
+        },
+    });
+}
+/**
+ * Builds the request body for a multipart upload.
+ *
+ * Deliberately avoids `FormData`. A `FormData` body is only encoded by the
+ * `fetch` that owns that `FormData` class — undici brands its own — so a body
+ * built from the global `FormData` and sent through undici's `fetch`, or the
+ * reverse, is stringified to the literal `"[object FormData]"` and the upload
+ * silently carries no file. The `form-data` package fares worse: neither
+ * `fetch` accepts it as a body at all. `Blob` and `ReadableStream` carry no
+ * such brand and work with whichever `fetch` dispatches the request,
+ * including a caller-supplied `customFetch`.
+ */
+function buildMultipartBody(args) {
+    const { file, fileName, fileContentType, additionalFields } = args;
+    const parts = layOutMultipart({ fileName, fileContentType, additionalFields });
+    const contentType = `multipart/form-data; boundary=${parts.boundary}`;
+    if (file instanceof Blob) {
+        // A Blob keeps its length, so the request gets a Content-Length and
+        // stays replayable if it has to be retried. File-backed Blobs (from
+        // `fs.openAsBlob`) stay lazy here, so nothing is read into memory.
+        return { body: new Blob([parts.head, file, parts.tail]), contentType, isStreamed: false };
+    }
+    return { body: streamMultipartBody(file, parts), contentType, isStreamed: true };
+}
 /**
  * Uploads a file using multipart/form-data.
  *
@@ -111,69 +242,52 @@ async function uploadMultipartFile(args) {
     if (requestId) {
         headers['X-Request-Id'] = requestId;
     }
+    // Resolve the file to something every `fetch` accepts as a body part: a
+    // Blob where the size is known up front, or a Node stream that gets piped
+    // through untouched.
+    let filePart;
+    let resolvedFileName;
     if (file instanceof Blob) {
-        // Browser path: use native FormData
-        const form = new globalThis.FormData();
-        const resolvedFileName = fileName || (file instanceof File ? file.name : undefined) || 'upload';
-        form.append('file', file, resolvedFileName);
-        for (const [key, value] of Object.entries(additionalFields)) {
-            if (value !== undefined && value !== null) {
-                form.append(key, value.toString());
-            }
+        filePart = file;
+        resolvedFileName = fileName || (file instanceof File ? file.name : undefined) || 'upload';
+    }
+    else if (typeof file === 'string') {
+        // File path: Node-only, so import lazily to keep browser bundles clean.
+        const [fsModule, pathModule] = await Promise.all([Promise.resolve().then(() => __importStar(require('fs'))), Promise.resolve().then(() => __importStar(require('path')))]);
+        resolvedFileName = fileName || pathModule.basename(file);
+        // `openAsBlob` reads the file lazily, so a large upload is not pulled
+        // into memory, and the resulting body still has a known length.
+        filePart = await fsModule.openAsBlob(file);
+    }
+    else if (Buffer.isBuffer(file)) {
+        if (!fileName) {
+            throw new Error('fileName is required when uploading from a Buffer');
         }
-        // Don't set Content-Type — let fetch set it with the correct multipart boundary
-        body = form;
+        resolvedFileName = fileName;
+        filePart = new Blob([
+            new Uint8Array(file.buffer, file.byteOffset, file.byteLength),
+        ]);
     }
     else {
-        // Node path: dynamically import Node-only modules
-        const [FormDataModule, fsModule, pathModule] = await Promise.all([
-            Promise.resolve().then(() => __importStar(require('form-data'))),
-            Promise.resolve().then(() => __importStar(require('fs'))),
-            Promise.resolve().then(() => __importStar(require('path'))),
-        ]);
-        const FormData = FormDataModule.default;
-        const form = new FormData();
-        if (typeof file === 'string') {
-            // File path - create read stream
-            const resolvedFileName = fileName || pathModule.basename(file);
-            form.append('file', fsModule.createReadStream(file), resolvedFileName);
-        }
-        else if (Buffer.isBuffer(file)) {
-            // Buffer - require fileName
-            if (!fileName) {
-                throw new Error('fileName is required when uploading from a Buffer');
-            }
-            const contentType = getContentTypeFromFileName(fileName);
-            form.append('file', file, {
-                filename: fileName,
-                contentType: contentType,
-            });
-        }
-        else {
-            // Stream - require fileName
-            if (!fileName) {
-                throw new Error('fileName is required when uploading from a stream');
-            }
-            form.append('file', file, fileName);
+        if (!fileName) {
+            throw new Error('fileName is required when uploading from a stream');
         }
-        for (const [key, value] of Object.entries(additionalFields)) {
-            if (value !== undefined && value !== null) {
-                form.append(key, value.toString());
-            }
-        }
-        Object.assign(headers, form.getHeaders());
-        body = form;
+        resolvedFileName = fileName;
+        filePart = file;
     }
-    // Make the request using fetch
-    const response = await (0, fetch_with_retry_1.fetchWithRetry)({
-        url,
-        options: {
-            method: 'POST',
-            body,
-            headers,
-            timeout: 30000, // 30 second timeout for file uploads
-        },
-        customFetch,
+    const multipart = buildMultipartBody({
+        file: filePart,
+        fileName: resolvedFileName,
+        fileContentType: (filePart instanceof Blob ? filePart.type : undefined) ||
+            getContentTypeFromFileName(resolvedFileName),
+        additionalFields,
     });
+    // The boundary is ours, so Content-Type has to be set explicitly — `fetch`
+    // only fills it in for a `FormData` body.
+    headers['Content-Type'] = multipart.contentType;
+    body = multipart.body;
+    // Make the request using fetch
+    const response = await (0, fetch_with_retry_1.fetchWithRetry)(Object.assign(Object.assign({ url, options: Object.assign({ method: 'POST', body,
+            headers, timeout: 30000 }, (multipart.isStreamed ? { duplex: 'half' } : {})) }, (multipart.isStreamed ? { retryConfig: { retries: 0 } } : {})), { customFetch }));
     return (0, case_conversion_1.camelCaseKeys)(response.data);
 }

package/dist/esm/index.js

@@ -2,4 +2,4 @@ export * from './todoist-api.js';
 export * from './authentication.js';
 export * from './types/index.js';
 export * from './utils/index.js';
-export { getDefaultDispatcher } from './transport/http-dispatcher.js';
+export { getDefaultDispatcher, getDefaultTransport } from './transport/http-dispatcher.js';

package/dist/esm/transport/http-dispatcher.js

@@ -10,6 +10,23 @@ let defaultTransportPromise;
  * The default dispatcher and its paired `fetch`, as a single value so the two
  * are always read consistently. Resolves to `undefined` outside Node (browser/
  * edge), where callers use the global `fetch` with no dispatcher.
+ *
+ * Use this when supplying a `customFetch` that should still honour the proxy
+ * environment variables (`HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY`) and decode
+ * compressed responses the way the SDK does by default.
+ *
+ * Both halves must be used together. `dispatcher` decompresses the response
+ * body itself, so a `fetch` from a different undici build will try to decode
+ * it a second time and the request fails mid-stream with `terminated`. A
+ * `fetch` of `undefined` means the runtime's global `fetch` is the correct
+ * partner for this dispatcher.
+ *
+ * @example
+ * ```ts
+ * const transport = await getDefaultTransport()
+ * const fetchImpl = transport?.fetch ?? fetch
+ * const response = await fetchImpl(url, { ...options, dispatcher: transport?.dispatcher })
+ * ```
  */
 export function getDefaultTransport() {
     if (!isNodeEnvironment()) {
@@ -29,6 +46,14 @@ export function getDefaultTransport() {
     }
     return defaultTransportPromise;
 }
+/**
+ * The default dispatcher on its own.
+ *
+ * @deprecated Use {@link getDefaultTransport} instead, which returns this
+ * dispatcher together with the `fetch` it must be used with. Attaching this
+ * dispatcher to the runtime's global `fetch` decodes compressed responses
+ * twice on Node 26 and the request fails with `terminated`.
+ */
 export async function getDefaultDispatcher() {
     var _a;
     return (_a = (await getDefaultTransport())) === null || _a === void 0 ? void 0 : _a.dispatcher;

package/dist/esm/utils/multipart-upload.js

@@ -1,3 +1,24 @@
+var __await = (this && this.__await) || function (v) { return this instanceof __await ? (this.v = v, this) : new __await(v); }
+var __asyncValues = (this && this.__asyncValues) || function (o) {
+    if (!Symbol.asyncIterator) throw new TypeError("Symbol.asyncIterator is not defined.");
+    var m = o[Symbol.asyncIterator], i;
+    return m ? m.call(o) : (o = typeof __values === "function" ? __values(o) : o[Symbol.iterator](), i = {}, verb("next"), verb("throw"), verb("return"), i[Symbol.asyncIterator] = function () { return this; }, i);
+    function verb(n) { i[n] = o[n] && function (v) { return new Promise(function (resolve, reject) { v = o[n](v), settle(resolve, reject, v.done, v.value); }); }; }
+    function settle(resolve, reject, d, v) { Promise.resolve(v).then(function(v) { resolve({ value: v, done: d }); }, reject); }
+};
+var __asyncGenerator = (this && this.__asyncGenerator) || function (thisArg, _arguments, generator) {
+    if (!Symbol.asyncIterator) throw new TypeError("Symbol.asyncIterator is not defined.");
+    var g = generator.apply(thisArg, _arguments || []), i, q = [];
+    return i = Object.create((typeof AsyncIterator === "function" ? AsyncIterator : Object).prototype), verb("next"), verb("throw"), verb("return", awaitReturn), i[Symbol.asyncIterator] = function () { return this; }, i;
+    function awaitReturn(f) { return function (v) { return Promise.resolve(v).then(f, reject); }; }
+    function verb(n, f) { if (g[n]) { i[n] = function (v) { return new Promise(function (a, b) { q.push([n, v, a, b]) > 1 || resume(n, v); }); }; if (f) i[n] = f(i[n]); } }
+    function resume(n, v) { try { step(g[n](v)); } catch (e) { settle(q[0][3], e); } }
+    function step(r) { r.value instanceof __await ? Promise.resolve(r.value.v).then(fulfill, reject) : settle(q[0][2], r); }
+    function fulfill(value) { resume("next", value); }
+    function reject(value) { resume("throw", value); }
+    function settle(f, v) { if (f(v), q.shift(), q.length) resume(q[0][0], q[0][1]); }
+};
+import { v4 as uuidv4 } from 'uuid';
 import { fetchWithRetry } from '../transport/fetch-with-retry.js';
 import { camelCaseKeys } from './case-conversion.js';
 /**
@@ -23,6 +44,116 @@ function getContentTypeFromFileName(fileName) {
             return 'application/octet-stream';
     }
 }
+/**
+ * Escapes a value for use inside a quoted `Content-Disposition` parameter,
+ * where a raw quote would end the value early and a raw CR or LF would end the
+ * header. Note that a lone CR needs escaping too, not just CRLF pairs.
+ *
+ * This is the same escaping the platform's own `FormData` encoder applies, so
+ * servers see exactly what they would from any browser or from undici.
+ */
+function escapeDispositionValue(value) {
+    return value.replace(/"/g, '%22').replace(/\r/g, '%0D').replace(/\n/g, '%0A');
+}
+/**
+ * Lays out a `multipart/form-data` payload around a single file part, as the
+ * text that goes before and after the file content. Keeping the file content
+ * out of it lets the same layout serve both a `Blob` body and a streamed one.
+ */
+function layOutMultipart(args) {
+    const { fileName, fileContentType, additionalFields } = args;
+    const boundary = `----todoist-sdk-${uuidv4()}`;
+    const head = `--${boundary}\r\n` +
+        `Content-Disposition: form-data; name="file"; filename="${escapeDispositionValue(fileName)}"\r\n` +
+        `Content-Type: ${fileContentType}\r\n\r\n`;
+    let tail = '\r\n';
+    for (const [key, value] of Object.entries(additionalFields)) {
+        if (value !== undefined && value !== null) {
+            tail +=
+                `--${boundary}\r\n` +
+                    `Content-Disposition: form-data; name="${escapeDispositionValue(key)}"\r\n\r\n` +
+                    `${value.toString()}\r\n`;
+        }
+    }
+    tail += `--${boundary}--\r\n`;
+    return { boundary, head, tail };
+}
+/**
+ * Wraps a Node readable stream as a `multipart/form-data` request body.
+ *
+ * The result is a web `ReadableStream`, which both the runtime's `fetch` and
+ * undici's own accept — unlike a Node stream or a `FormData`, either of which
+ * only works with one particular client. The file is never buffered, so the
+ * request is sent with `Transfer-Encoding: chunked`.
+ */
+function streamMultipartBody(file, parts) {
+    const encoder = new TextEncoder();
+    function chunks() {
+        return __asyncGenerator(this, arguments, function* chunks_1() {
+            var _a, e_1, _b, _c;
+            yield yield __await(encoder.encode(parts.head));
+            try {
+                for (var _d = true, file_1 = __asyncValues(file), file_1_1; file_1_1 = yield __await(file_1.next()), _a = file_1_1.done, !_a; _d = true) {
+                    _c = file_1_1.value;
+                    _d = false;
+                    const chunk = _c;
+                    yield yield __await(typeof chunk === 'string' ? encoder.encode(chunk) : new Uint8Array(chunk));
+                }
+            }
+            catch (e_1_1) { e_1 = { error: e_1_1 }; }
+            finally {
+                try {
+                    if (!_d && !_a && (_b = file_1.return)) yield __await(_b.call(file_1));
+                }
+                finally { if (e_1) throw e_1.error; }
+            }
+            yield yield __await(encoder.encode(parts.tail));
+        });
+    }
+    const iterator = chunks();
+    // Driven by hand rather than with `ReadableStream.from`, which is absent
+    // from this project's DOM lib types and is still missing in some browsers,
+    // or `Readable.toWeb`, which would drag a Node-only import into a module
+    // that browsers also load.
+    return new ReadableStream({
+        async pull(controller) {
+            const { value, done } = await iterator.next();
+            if (done) {
+                controller.close();
+                return;
+            }
+            controller.enqueue(value);
+        },
+        async cancel(reason) {
+            var _a;
+            await ((_a = iterator.return) === null || _a === void 0 ? void 0 : _a.call(iterator, reason));
+        },
+    });
+}
+/**
+ * Builds the request body for a multipart upload.
+ *
+ * Deliberately avoids `FormData`. A `FormData` body is only encoded by the
+ * `fetch` that owns that `FormData` class — undici brands its own — so a body
+ * built from the global `FormData` and sent through undici's `fetch`, or the
+ * reverse, is stringified to the literal `"[object FormData]"` and the upload
+ * silently carries no file. The `form-data` package fares worse: neither
+ * `fetch` accepts it as a body at all. `Blob` and `ReadableStream` carry no
+ * such brand and work with whichever `fetch` dispatches the request,
+ * including a caller-supplied `customFetch`.
+ */
+function buildMultipartBody(args) {
+    const { file, fileName, fileContentType, additionalFields } = args;
+    const parts = layOutMultipart({ fileName, fileContentType, additionalFields });
+    const contentType = `multipart/form-data; boundary=${parts.boundary}`;
+    if (file instanceof Blob) {
+        // A Blob keeps its length, so the request gets a Content-Length and
+        // stays replayable if it has to be retried. File-backed Blobs (from
+        // `fs.openAsBlob`) stay lazy here, so nothing is read into memory.
+        return { body: new Blob([parts.head, file, parts.tail]), contentType, isStreamed: false };
+    }
+    return { body: streamMultipartBody(file, parts), contentType, isStreamed: true };
+}
 /**
  * Uploads a file using multipart/form-data.
  *
@@ -75,69 +206,52 @@ export async function uploadMultipartFile(args) {
     if (requestId) {
         headers['X-Request-Id'] = requestId;
     }
+    // Resolve the file to something every `fetch` accepts as a body part: a
+    // Blob where the size is known up front, or a Node stream that gets piped
+    // through untouched.
+    let filePart;
+    let resolvedFileName;
     if (file instanceof Blob) {
-        // Browser path: use native FormData
-        const form = new globalThis.FormData();
-        const resolvedFileName = fileName || (file instanceof File ? file.name : undefined) || 'upload';
-        form.append('file', file, resolvedFileName);
-        for (const [key, value] of Object.entries(additionalFields)) {
-            if (value !== undefined && value !== null) {
-                form.append(key, value.toString());
-            }
+        filePart = file;
+        resolvedFileName = fileName || (file instanceof File ? file.name : undefined) || 'upload';
+    }
+    else if (typeof file === 'string') {
+        // File path: Node-only, so import lazily to keep browser bundles clean.
+        const [fsModule, pathModule] = await Promise.all([import('fs'), import('path')]);
+        resolvedFileName = fileName || pathModule.basename(file);
+        // `openAsBlob` reads the file lazily, so a large upload is not pulled
+        // into memory, and the resulting body still has a known length.
+        filePart = await fsModule.openAsBlob(file);
+    }
+    else if (Buffer.isBuffer(file)) {
+        if (!fileName) {
+            throw new Error('fileName is required when uploading from a Buffer');
         }
-        // Don't set Content-Type — let fetch set it with the correct multipart boundary
-        body = form;
+        resolvedFileName = fileName;
+        filePart = new Blob([
+            new Uint8Array(file.buffer, file.byteOffset, file.byteLength),
+        ]);
     }
     else {
-        // Node path: dynamically import Node-only modules
-        const [FormDataModule, fsModule, pathModule] = await Promise.all([
-            import('form-data'),
-            import('fs'),
-            import('path'),
-        ]);
-        const FormData = FormDataModule.default;
-        const form = new FormData();
-        if (typeof file === 'string') {
-            // File path - create read stream
-            const resolvedFileName = fileName || pathModule.basename(file);
-            form.append('file', fsModule.createReadStream(file), resolvedFileName);
-        }
-        else if (Buffer.isBuffer(file)) {
-            // Buffer - require fileName
-            if (!fileName) {
-                throw new Error('fileName is required when uploading from a Buffer');
-            }
-            const contentType = getContentTypeFromFileName(fileName);
-            form.append('file', file, {
-                filename: fileName,
-                contentType: contentType,
-            });
-        }
-        else {
-            // Stream - require fileName
-            if (!fileName) {
-                throw new Error('fileName is required when uploading from a stream');
-            }
-            form.append('file', file, fileName);
+        if (!fileName) {
+            throw new Error('fileName is required when uploading from a stream');
         }
-        for (const [key, value] of Object.entries(additionalFields)) {
-            if (value !== undefined && value !== null) {
-                form.append(key, value.toString());
-            }
-        }
-        Object.assign(headers, form.getHeaders());
-        body = form;
+        resolvedFileName = fileName;
+        filePart = file;
     }
-    // Make the request using fetch
-    const response = await fetchWithRetry({
-        url,
-        options: {
-            method: 'POST',
-            body,
-            headers,
-            timeout: 30000, // 30 second timeout for file uploads
-        },
-        customFetch,
+    const multipart = buildMultipartBody({
+        file: filePart,
+        fileName: resolvedFileName,
+        fileContentType: (filePart instanceof Blob ? filePart.type : undefined) ||
+            getContentTypeFromFileName(resolvedFileName),
+        additionalFields,
     });
+    // The boundary is ours, so Content-Type has to be set explicitly — `fetch`
+    // only fills it in for a `FormData` body.
+    headers['Content-Type'] = multipart.contentType;
+    body = multipart.body;
+    // Make the request using fetch
+    const response = await fetchWithRetry(Object.assign(Object.assign({ url, options: Object.assign({ method: 'POST', body,
+            headers, timeout: 30000 }, (multipart.isStreamed ? { duplex: 'half' } : {})) }, (multipart.isStreamed ? { retryConfig: { retries: 0 } } : {})), { customFetch }));
     return camelCaseKeys(response.data);
 }

package/dist/types/index.d.ts

@@ -2,4 +2,5 @@ export * from './todoist-api.js';
 export * from './authentication.js';
 export * from './types/index.js';
 export * from './utils/index.js';
-export { getDefaultDispatcher } from './transport/http-dispatcher.js';
+export { getDefaultDispatcher, getDefaultTransport } from './transport/http-dispatcher.js';
+export type { DefaultTransport } from './transport/http-dispatcher.js';

package/dist/types/transport/http-dispatcher.d.ts

@@ -7,7 +7,7 @@ type UndiciFetch = typeof import('undici').fetch;
  * never observe a dispatcher paired with a mismatched `fetch` — see
  * {@link getDefaultFetch} for why the pairing matters.
  */
-type DefaultTransport = {
+export type DefaultTransport = {
     dispatcher: Dispatcher;
     fetch: UndiciFetch | undefined;
 };
@@ -15,8 +15,33 @@ type DefaultTransport = {
  * The default dispatcher and its paired `fetch`, as a single value so the two
  * are always read consistently. Resolves to `undefined` outside Node (browser/
  * edge), where callers use the global `fetch` with no dispatcher.
+ *
+ * Use this when supplying a `customFetch` that should still honour the proxy
+ * environment variables (`HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY`) and decode
+ * compressed responses the way the SDK does by default.
+ *
+ * Both halves must be used together. `dispatcher` decompresses the response
+ * body itself, so a `fetch` from a different undici build will try to decode
+ * it a second time and the request fails mid-stream with `terminated`. A
+ * `fetch` of `undefined` means the runtime's global `fetch` is the correct
+ * partner for this dispatcher.
+ *
+ * @example
+ * ```ts
+ * const transport = await getDefaultTransport()
+ * const fetchImpl = transport?.fetch ?? fetch
+ * const response = await fetchImpl(url, { ...options, dispatcher: transport?.dispatcher })
+ * ```
  */
 export declare function getDefaultTransport(): Promise<DefaultTransport | undefined>;
+/**
+ * The default dispatcher on its own.
+ *
+ * @deprecated Use {@link getDefaultTransport} instead, which returns this
+ * dispatcher together with the `fetch` it must be used with. Attaching this
+ * dispatcher to the runtime's global `fetch` decodes compressed responses
+ * twice on Node 26 and the request fails with `terminated`.
+ */
 export declare function getDefaultDispatcher(): Promise<Dispatcher | undefined>;
 /**
  * The `fetch` implementation that must be used with the default dispatcher.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@doist/todoist-sdk",
-    "version": "14.1.0",
+    "version": "14.2.0",
     "description": "The official TypeScript SDK for the Todoist REST API.",
     "author": "Doist developers",
     "repository": "https://github.com/Doist/todoist-sdk-typescript",
@@ -53,9 +53,8 @@
     "dependencies": {
         "camelcase": "6.3.0",
         "emoji-regex": "10.6.0",
-        "form-data": "4.0.6",
         "ts-custom-error": "^3.2.0",
-        "undici": "7.24.8",
+        "undici": "^7.29.0",
         "uuid": "11.1.1",
         "zod": "4.3.6"
     },