@humeai/audio-decisions 0.0.1 → 0.1.0

package/dist/esm/core/fetcher/getFetchFn.d.mts

@@ -0,0 +1 @@
+export declare function getFetchFn(): Promise<typeof fetch>;

package/dist/esm/core/fetcher/getFetchFn.mjs

@@ -0,0 +1,14 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+export function getFetchFn() {
+    return __awaiter(this, void 0, void 0, function* () {
+        return fetch;
+    });
+}

package/dist/esm/core/fetcher/getHeader.d.mts

@@ -0,0 +1 @@
+export declare function getHeader(headers: Record<string, any>, header: string): string | undefined;

package/dist/esm/core/fetcher/getHeader.mjs

@@ -0,0 +1,8 @@
+export function getHeader(headers, header) {
+    for (const [headerKey, headerValue] of Object.entries(headers)) {
+        if (headerKey.toLowerCase() === header.toLowerCase()) {
+            return headerValue;
+        }
+    }
+    return undefined;
+}

package/dist/esm/core/fetcher/getRequestBody.d.mts

@@ -0,0 +1,7 @@
+export declare namespace GetRequestBody {
+    interface Args {
+        body: unknown;
+        type: "json" | "file" | "bytes" | "form" | "other";
+    }
+}
+export declare function getRequestBody({ body, type }: GetRequestBody.Args): Promise<BodyInit | undefined>;

package/dist/esm/core/fetcher/getRequestBody.mjs

@@ -0,0 +1,24 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { toJson } from "../json.mjs";
+import { toQueryString } from "../url/qs.mjs";
+export function getRequestBody(_a) {
+    return __awaiter(this, arguments, void 0, function* ({ body, type }) {
+        if (type === "form") {
+            return toQueryString(body, { arrayFormat: "repeat", encode: true });
+        }
+        if (type.includes("json")) {
+            return toJson(body);
+        }
+        else {
+            return body;
+        }
+    });
+}

package/dist/esm/core/fetcher/getResponseBody.d.mts

@@ -0,0 +1,17 @@
+export type ResponseBodyError = {
+    ok: false;
+    error: {
+        reason: "non-json";
+        statusCode: number;
+        rawBody: string;
+    } | {
+        reason: "body-is-null";
+        statusCode: number;
+    };
+};
+/**
+ * Returns true when `value` is a failure record created by `getResponseBody` (for example malformed JSON),
+ * as opposed to a parsed JSON body that happens to have the same shape.
+ */
+export declare function isResponseBodyError(value: unknown): value is ResponseBodyError;
+export declare function getResponseBody(response: Response, responseType?: string): Promise<unknown>;

package/dist/esm/core/fetcher/getResponseBody.mjs

@@ -0,0 +1,81 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { fromJson } from "../json.mjs";
+import { getBinaryResponse } from "./BinaryResponse.mjs";
+// Pins the upstream Response so undici's FinalizationRegistry can't GC it and cancel the body stream.
+function retainResponse(target, response) {
+    Object.defineProperty(target, "__fern_response_ref", {
+        value: response,
+        enumerable: false,
+        configurable: true,
+        writable: false,
+    });
+}
+const responseBodyErrors = new WeakSet();
+function responseBodyError(error) {
+    const record = { ok: false, error };
+    responseBodyErrors.add(record);
+    return record;
+}
+/**
+ * Returns true when `value` is a failure record created by `getResponseBody` (for example malformed JSON),
+ * as opposed to a parsed JSON body that happens to have the same shape.
+ */
+export function isResponseBodyError(value) {
+    return typeof value === "object" && value != null && responseBodyErrors.has(value);
+}
+export function getResponseBody(response, responseType) {
+    return __awaiter(this, void 0, void 0, function* () {
+        switch (responseType) {
+            case "binary-response":
+                return getBinaryResponse(response);
+            case "blob":
+                return yield response.blob();
+            case "arrayBuffer":
+                return yield response.arrayBuffer();
+            case "sse":
+                if (response.body == null) {
+                    return responseBodyError({
+                        reason: "body-is-null",
+                        statusCode: response.status,
+                    });
+                }
+                retainResponse(response.body, response);
+                return response.body;
+            case "streaming":
+                if (response.body == null) {
+                    return responseBodyError({
+                        reason: "body-is-null",
+                        statusCode: response.status,
+                    });
+                }
+                retainResponse(response.body, response);
+                return response.body;
+            case "text":
+                return yield response.text();
+        }
+        // if responseType is "json" or not specified, try to parse as JSON
+        const text = yield response.text();
+        if (text.length > 0) {
+            try {
+                const responseBody = fromJson(text);
+                return responseBody;
+            }
+            catch (_err) {
+                return responseBodyError({
+                    reason: "non-json",
+                    statusCode: response.status,
+                    rawBody: text,
+                });
+            }
+        }
+        return undefined;
+    });
+}

package/dist/esm/core/fetcher/index.d.mts

@@ -0,0 +1,13 @@
+export type { APIResponse } from "./APIResponse.mjs";
+export type { BinaryResponse } from "./BinaryResponse.mjs";
+export type { EndpointMetadata } from "./EndpointMetadata.mjs";
+export { EndpointSupplier } from "./EndpointSupplier.mjs";
+export type { Fetcher, FetchFunction } from "./Fetcher.mjs";
+export { fetcher } from "./Fetcher.mjs";
+export { getHeader } from "./getHeader.mjs";
+export { HttpResponsePromise } from "./HttpResponsePromise.mjs";
+export type { PassthroughRequest } from "./makePassthroughRequest.mjs";
+export { makePassthroughRequest } from "./makePassthroughRequest.mjs";
+export type { RawResponse, WithRawResponse } from "./RawResponse.mjs";
+export { abortRawResponse, toRawResponse, unknownRawResponse } from "./RawResponse.mjs";
+export { Supplier } from "./Supplier.mjs";

package/dist/esm/core/fetcher/index.mjs

@@ -0,0 +1,7 @@
+export { EndpointSupplier } from "./EndpointSupplier.mjs";
+export { fetcher } from "./Fetcher.mjs";
+export { getHeader } from "./getHeader.mjs";
+export { HttpResponsePromise } from "./HttpResponsePromise.mjs";
+export { makePassthroughRequest } from "./makePassthroughRequest.mjs";
+export { abortRawResponse, toRawResponse, unknownRawResponse } from "./RawResponse.mjs";
+export { Supplier } from "./Supplier.mjs";

package/dist/esm/core/fetcher/makePassthroughRequest.d.mts

@@ -0,0 +1,49 @@
+import { type LogConfig, type Logger } from "../logging/logger.mjs";
+import { Supplier } from "./Supplier.mjs";
+export declare namespace PassthroughRequest {
+    /**
+     * Per-request options that can override the SDK client defaults.
+     */
+    interface RequestOptions {
+        /** Override the default timeout for this request (in seconds). */
+        timeoutInSeconds?: number;
+        /** Override the default number of retries for this request. */
+        maxRetries?: number;
+        /** Additional headers to include in this request. */
+        headers?: Record<string, string>;
+        /** Abort signal for this request. */
+        abortSignal?: AbortSignal;
+    }
+    /**
+     * SDK client configuration used by the passthrough fetch method.
+     */
+    interface ClientOptions {
+        /** The base URL or environment for the client. */
+        environment?: Supplier<string>;
+        /** Override the base URL. */
+        baseUrl?: Supplier<string>;
+        /** Default headers to include in requests. */
+        headers?: Record<string, unknown>;
+        /** Default maximum time to wait for a response in seconds. */
+        timeoutInSeconds?: number;
+        /** Default number of times to retry the request. Defaults to 2. */
+        maxRetries?: number;
+        /** A custom fetch function. */
+        fetch?: typeof fetch;
+        /** Logging configuration. */
+        logging?: LogConfig | Logger;
+        /** A function that returns auth headers. */
+        getAuthHeaders?: () => Promise<Record<string, string>>;
+    }
+}
+/**
+ * Makes a passthrough HTTP request using the SDK's configuration (auth, retry, logging, etc.)
+ * while mimicking the standard `fetch` API.
+ *
+ * @param input - The URL, path, or Request object. If a relative path, it will be resolved against the configured base URL.
+ * @param init - Standard RequestInit options (method, headers, body, signal, etc.)
+ * @param clientOptions - SDK client options (auth, default headers, logging, etc.)
+ * @param requestOptions - Per-request overrides (timeout, retries, extra headers, abort signal).
+ * @returns A standard Response object.
+ */
+export declare function makePassthroughRequest(input: Request | string | URL, init: RequestInit | undefined, clientOptions: PassthroughRequest.ClientOptions, requestOptions?: PassthroughRequest.RequestOptions): Promise<Response>;

package/dist/esm/core/fetcher/makePassthroughRequest.mjs

@@ -0,0 +1,170 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { createLogger } from "../logging/logger.mjs";
+import { join } from "../url/join.mjs";
+import { EndpointSupplier } from "./EndpointSupplier.mjs";
+import { getFetchFn } from "./getFetchFn.mjs";
+import { makeRequest } from "./makeRequest.mjs";
+import { redactUrl } from "./redactUrl.mjs";
+import { requestWithRetries } from "./requestWithRetries.mjs";
+import { Supplier } from "./Supplier.mjs";
+import { TIMEOUT } from "./signals.mjs";
+/**
+ * Makes a passthrough HTTP request using the SDK's configuration (auth, retry, logging, etc.)
+ * while mimicking the standard `fetch` API.
+ *
+ * @param input - The URL, path, or Request object. If a relative path, it will be resolved against the configured base URL.
+ * @param init - Standard RequestInit options (method, headers, body, signal, etc.)
+ * @param clientOptions - SDK client options (auth, default headers, logging, etc.)
+ * @param requestOptions - Per-request overrides (timeout, retries, extra headers, abort signal).
+ * @returns A standard Response object.
+ */
+export function makePassthroughRequest(input, init, clientOptions, requestOptions) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c, _d, _e, _f, _g;
+        const logger = createLogger(clientOptions.logging);
+        // Extract URL and default init properties from Request object if provided
+        let url;
+        let effectiveInit = init;
+        if (input instanceof Request) {
+            url = input.url;
+            // If no explicit init provided, extract properties from the Request object
+            if (init == null) {
+                effectiveInit = {
+                    method: input.method,
+                    headers: Object.fromEntries(input.headers.entries()),
+                    body: input.body,
+                    signal: input.signal,
+                    credentials: input.credentials,
+                    cache: input.cache,
+                    redirect: input.redirect,
+                    referrer: input.referrer,
+                    integrity: input.integrity,
+                    mode: input.mode,
+                };
+            }
+        }
+        else {
+            url = input instanceof URL ? input.toString() : input;
+        }
+        // Resolve the base URL
+        const baseUrl = (_a = (clientOptions.baseUrl != null ? yield Supplier.get(clientOptions.baseUrl) : undefined)) !== null && _a !== void 0 ? _a : (clientOptions.environment != null ? yield Supplier.get(clientOptions.environment) : undefined);
+        // Determine the full URL
+        let fullUrl;
+        if (url.startsWith("http://") || url.startsWith("https://")) {
+            fullUrl = url;
+        }
+        else if (baseUrl != null) {
+            fullUrl = join(baseUrl, url);
+        }
+        else {
+            fullUrl = url;
+        }
+        // Merge headers: SDK default headers -> auth headers -> user-provided headers
+        const mergedHeaders = {};
+        // Apply SDK default headers (resolve suppliers)
+        if (clientOptions.headers != null) {
+            for (const [key, value] of Object.entries(clientOptions.headers)) {
+                const resolved = yield EndpointSupplier.get(value, { endpointMetadata: {} });
+                if (resolved != null) {
+                    mergedHeaders[key.toLowerCase()] = `${resolved}`;
+                }
+            }
+        }
+        // Apply auth headers, but only when the resolved URL targets the configured base URL.
+        // This prevents the SDK's credentials from leaking to an unrelated host when a caller
+        // passes an absolute cross-origin URL into the passthrough fetch escape hatch.
+        if (clientOptions.getAuthHeaders != null && targetsBaseUrl(fullUrl, baseUrl)) {
+            const authHeaders = yield clientOptions.getAuthHeaders();
+            for (const [key, value] of Object.entries(authHeaders)) {
+                mergedHeaders[key.toLowerCase()] = value;
+            }
+        }
+        // Apply user-provided headers from init
+        if ((effectiveInit === null || effectiveInit === void 0 ? void 0 : effectiveInit.headers) != null) {
+            const initHeaders = effectiveInit.headers instanceof Headers
+                ? Object.fromEntries(effectiveInit.headers.entries())
+                : Array.isArray(effectiveInit.headers)
+                    ? Object.fromEntries(effectiveInit.headers)
+                    : effectiveInit.headers;
+            for (const [key, value] of Object.entries(initHeaders)) {
+                if (value != null) {
+                    mergedHeaders[key.toLowerCase()] = value;
+                }
+            }
+        }
+        // Apply per-request option headers (highest priority)
+        if ((requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.headers) != null) {
+            for (const [key, value] of Object.entries(requestOptions.headers)) {
+                mergedHeaders[key.toLowerCase()] = value;
+            }
+        }
+        const method = (_b = effectiveInit === null || effectiveInit === void 0 ? void 0 : effectiveInit.method) !== null && _b !== void 0 ? _b : "GET";
+        const body = effectiveInit === null || effectiveInit === void 0 ? void 0 : effectiveInit.body;
+        const timeoutInSeconds = (_c = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.timeoutInSeconds) !== null && _c !== void 0 ? _c : clientOptions.timeoutInSeconds;
+        const timeoutMs = timeoutInSeconds != null ? timeoutInSeconds * 1000 : undefined;
+        const maxRetries = (_d = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.maxRetries) !== null && _d !== void 0 ? _d : clientOptions.maxRetries;
+        const abortSignal = (_f = (_e = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.abortSignal) !== null && _e !== void 0 ? _e : effectiveInit === null || effectiveInit === void 0 ? void 0 : effectiveInit.signal) !== null && _f !== void 0 ? _f : undefined;
+        const fetchFn = (_g = clientOptions.fetch) !== null && _g !== void 0 ? _g : (yield getFetchFn());
+        if (logger.isDebug()) {
+            logger.debug("Making passthrough HTTP request", {
+                method,
+                url: redactUrl(fullUrl),
+                hasBody: body != null,
+            });
+        }
+        let response;
+        try {
+            response = yield requestWithRetries(() => __awaiter(this, void 0, void 0, function* () {
+                return makeRequest(fetchFn, fullUrl, method, mergedHeaders, body !== null && body !== void 0 ? body : undefined, timeoutMs, abortSignal, (effectiveInit === null || effectiveInit === void 0 ? void 0 : effectiveInit.credentials) === "include", undefined, // duplex
+                false);
+            }), maxRetries, abortSignal);
+        }
+        catch (error) {
+            // Match `fetch`: a timeout rejects with an Error named "TimeoutError", not the bare abort reason.
+            if (error === TIMEOUT) {
+                throw createTimeoutError();
+            }
+            throw error;
+        }
+        if (logger.isDebug()) {
+            logger.debug("Passthrough HTTP request completed", {
+                method,
+                url: redactUrl(fullUrl),
+                statusCode: response.status,
+            });
+        }
+        return response;
+    });
+}
+function createTimeoutError() {
+    const error = new Error("The request timed out.");
+    error.name = "TimeoutError";
+    return error;
+}
+/**
+ * Returns true when the resolved request URL points at the same origin as the
+ * configured base URL. Relative paths are always joined onto the base URL, so
+ * they resolve to the base origin and return true. Absolute URLs only match when
+ * their origin equals the base origin. When there is no base URL to compare
+ * against, or either value is not a parseable absolute URL, this returns false so
+ * auth headers are not attached.
+ */
+function targetsBaseUrl(fullUrl, baseUrl) {
+    if (baseUrl == null) {
+        return false;
+    }
+    try {
+        return new URL(fullUrl).origin === new URL(baseUrl).origin;
+    }
+    catch (_a) {
+        return false;
+    }
+}

package/dist/esm/core/fetcher/makeRequest.d.mts

@@ -0,0 +1,11 @@
+export declare function isCacheNoStoreSupported(): boolean;
+/**
+ * Reset the cached result of `isCacheNoStoreSupported`. Exposed for testing only.
+ */
+export declare function resetCacheNoStoreSupported(): void;
+/**
+ * Clears the timeout that `makeRequest` kept running (with `keepTimeoutUntilBodyRead`) so that it also
+ * covered reading the response body.
+ */
+export declare function clearResponseTimeout(response: Response): void;
+export declare const makeRequest: (fetchFn: (url: string, init: RequestInit) => Promise<Response>, url: string, method: string, headers: Headers | Record<string, string>, requestBody: BodyInit | undefined, timeoutMs?: number, abortSignal?: AbortSignal, withCredentials?: boolean, duplex?: "half", disableCache?: boolean, keepTimeoutUntilBodyRead?: boolean) => Promise<Response>;

package/dist/esm/core/fetcher/makeRequest.mjs

@@ -0,0 +1,87 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { anySignal, getTimeoutSignal, TIMEOUT } from "./signals.mjs";
+/**
+ * Cached result of checking whether the current runtime supports
+ * the `cache` option in `Request`. Some runtimes (e.g. Cloudflare Workers)
+ * throw a TypeError when this option is used.
+ */
+let _cacheNoStoreSupported;
+export function isCacheNoStoreSupported() {
+    if (_cacheNoStoreSupported != null) {
+        return _cacheNoStoreSupported;
+    }
+    try {
+        new Request("http://localhost", { cache: "no-store" });
+        _cacheNoStoreSupported = true;
+    }
+    catch (_a) {
+        _cacheNoStoreSupported = false;
+    }
+    return _cacheNoStoreSupported;
+}
+/**
+ * Reset the cached result of `isCacheNoStoreSupported`. Exposed for testing only.
+ */
+export function resetCacheNoStoreSupported() {
+    _cacheNoStoreSupported = undefined;
+}
+const responseTimeouts = new WeakMap();
+/**
+ * Clears the timeout that `makeRequest` kept running (with `keepTimeoutUntilBodyRead`) so that it also
+ * covered reading the response body.
+ */
+export function clearResponseTimeout(response) {
+    const timeoutId = responseTimeouts.get(response);
+    if (timeoutId != null) {
+        clearTimeout(timeoutId);
+        responseTimeouts.delete(response);
+    }
+}
+export const makeRequest = (fetchFn, url, method, headers, requestBody, timeoutMs, abortSignal, withCredentials, duplex, disableCache, keepTimeoutUntilBodyRead) => __awaiter(void 0, void 0, void 0, function* () {
+    const signals = [];
+    let timeoutAbortId;
+    let timeoutSignal;
+    if (timeoutMs != null) {
+        const { signal, abortId } = getTimeoutSignal(timeoutMs);
+        timeoutAbortId = abortId;
+        timeoutSignal = signal;
+        signals.push(signal);
+    }
+    if (abortSignal != null) {
+        signals.push(abortSignal);
+    }
+    const newSignals = anySignal(signals);
+    let response;
+    try {
+        response = yield fetchFn(url, Object.assign({ method: method, headers, body: requestBody, signal: newSignals, credentials: withCredentials ? "include" : undefined, 
+            // @ts-ignore
+            duplex }, (disableCache && isCacheNoStoreSupported() ? { cache: "no-store" } : {})));
+    }
+    catch (error) {
+        if (timeoutAbortId != null) {
+            clearTimeout(timeoutAbortId);
+        }
+        // Some runtimes (e.g. Node 18) reject with their own error instead of the abort reason.
+        if ((timeoutSignal === null || timeoutSignal === void 0 ? void 0 : timeoutSignal.aborted) && !(abortSignal === null || abortSignal === void 0 ? void 0 : abortSignal.aborted)) {
+            throw TIMEOUT;
+        }
+        throw error;
+    }
+    if (timeoutAbortId != null) {
+        if (keepTimeoutUntilBodyRead) {
+            responseTimeouts.set(response, timeoutAbortId);
+        }
+        else {
+            clearTimeout(timeoutAbortId);
+        }
+    }
+    return response;
+});

package/dist/esm/core/fetcher/redactUrl.d.mts

@@ -0,0 +1,2 @@
+export declare const SENSITIVE_QUERY_PARAMS: Set<string>;
+export declare function redactUrl(url: string): string;

package/dist/esm/core/fetcher/redactUrl.mjs

@@ -0,0 +1,84 @@
+export const SENSITIVE_QUERY_PARAMS = new Set([
+    "api_key",
+    "api-key",
+    "apikey",
+    "token",
+    "access_token",
+    "access-token",
+    "auth_token",
+    "auth-token",
+    "password",
+    "passwd",
+    "secret",
+    "api_secret",
+    "api-secret",
+    "apisecret",
+    "key",
+    "session",
+    "session_id",
+    "session-id",
+]);
+export function redactUrl(url) {
+    const protocolIndex = url.indexOf("://");
+    if (protocolIndex === -1)
+        return url;
+    const afterProtocol = protocolIndex + 3;
+    // Find the first delimiter that marks the end of the authority section
+    const pathStart = url.indexOf("/", afterProtocol);
+    let queryStart = url.indexOf("?", afterProtocol);
+    let fragmentStart = url.indexOf("#", afterProtocol);
+    const firstDelimiter = Math.min(pathStart === -1 ? url.length : pathStart, queryStart === -1 ? url.length : queryStart, fragmentStart === -1 ? url.length : fragmentStart);
+    // Find the LAST @ before the delimiter (handles multiple @ in credentials)
+    let atIndex = -1;
+    for (let i = afterProtocol; i < firstDelimiter; i++) {
+        if (url[i] === "@") {
+            atIndex = i;
+        }
+    }
+    if (atIndex !== -1) {
+        url = `${url.slice(0, afterProtocol)}[REDACTED]@${url.slice(atIndex + 1)}`;
+    }
+    // Recalculate queryStart since url might have changed
+    queryStart = url.indexOf("?");
+    if (queryStart === -1)
+        return url;
+    fragmentStart = url.indexOf("#", queryStart);
+    const queryEnd = fragmentStart !== -1 ? fragmentStart : url.length;
+    const queryString = url.slice(queryStart + 1, queryEnd);
+    if (queryString.length === 0)
+        return url;
+    // FAST PATH: Quick check if any sensitive keywords present
+    // Using indexOf is faster than regex for simple substring matching
+    const lower = queryString.toLowerCase();
+    const hasSensitive = lower.includes("token") ||
+        lower.includes("key") ||
+        lower.includes("password") ||
+        lower.includes("passwd") ||
+        lower.includes("secret") ||
+        lower.includes("session") ||
+        lower.includes("auth");
+    if (!hasSensitive) {
+        return url;
+    }
+    // SLOW PATH: Parse and redact
+    const redactedParams = [];
+    const params = queryString.split("&");
+    for (const param of params) {
+        const equalIndex = param.indexOf("=");
+        if (equalIndex === -1) {
+            redactedParams.push(param);
+            continue;
+        }
+        const key = param.slice(0, equalIndex);
+        let shouldRedact = SENSITIVE_QUERY_PARAMS.has(key.toLowerCase());
+        if (!shouldRedact && key.includes("%")) {
+            try {
+                const decodedKey = decodeURIComponent(key);
+                shouldRedact = SENSITIVE_QUERY_PARAMS.has(decodedKey.toLowerCase());
+            }
+            catch (_a) { }
+        }
+        redactedParams.push(shouldRedact ? `${key}=[REDACTED]` : param);
+    }
+    return url.slice(0, queryStart + 1) + redactedParams.join("&") + url.slice(queryEnd);
+}

package/dist/esm/core/fetcher/requestWithRetries.d.mts

@@ -0,0 +1 @@
+export declare function requestWithRetries(requestFn: () => Promise<Response>, maxRetries?: number, abortSignal?: AbortSignal): Promise<Response>;