@outfoxx/sunday 2.0.0-beta.2 → 2.0.0-beta.21

package/build/request-adapters-compat.d.ts

@@ -0,0 +1,6 @@
+/** Compatibility entry point for the original public request-adapters subpath.
+ * Internal transports import the token-independent chain module directly.
+ */
+export * from './request-adapters.js';
+export { HeaderTokenAuthorizingAdapter, StaticHeaderTokenAuthorizingAdapter, RefreshingHeaderTokenAuthorizingAdapter, } from './header-token-adapters.js';
+export type { TokenAuthorization } from './header-token-adapters.js';

package/build/request-adapters-compat.js

@@ -0,0 +1,19 @@
+// Copyright 2020 Outfox, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+/** Compatibility entry point for the original public request-adapters subpath.
+ * Internal transports import the token-independent chain module directly.
+ */
+export * from './request-adapters.js';
+export { HeaderTokenAuthorizingAdapter, StaticHeaderTokenAuthorizingAdapter, RefreshingHeaderTokenAuthorizingAdapter, } from './header-token-adapters.js';
+//# sourceMappingURL=request-adapters-compat.js.map

package/build/request-adapters-compat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-adapters-compat.js","sourceRoot":"","sources":["../src/request-adapters-compat.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAC9B,EAAE;AACF,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,gDAAgD;AAChD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AAEjC;;GAEG;AACH,cAAc,uBAAuB,CAAC;AACtC,OAAO,EACL,6BAA6B,EAC7B,mCAAmC,EACnC,uCAAuC,GACxC,MAAM,4BAA4B,CAAC"}

package/build/request-adapters.d.ts

@@ -1,23 +1,13 @@
-import { RequestAdapter, Transport } from './transport.js';
-export declare abstract class HeaderTokenAuthorizingAdapter implements RequestAdapter {
-    header: string;
-    tokenHeaderType: string;
-    applyToken(request: Request, accessToken: string): Request;
-    abstract adapt(transport: Transport, request: Request): Promise<Request>;
-}
-export declare class StaticHeaderTokenAuthorizingAdapter extends HeaderTokenAuthorizingAdapter {
-    private readonly accessToken;
-    constructor(accessToken: string);
-    adapt(_transport: Transport, request: Request): Promise<Request>;
-}
-export interface TokenAuthorization {
-    token: string;
-    expires: Date;
-}
-export declare class RefreshingHeaderTokenAuthorizingAdapter extends HeaderTokenAuthorizingAdapter {
-    private readonly refresh;
-    private authorization?;
-    constructor(refresh: (transport: Transport) => Promise<TokenAuthorization>);
-    shouldRefresh(): boolean;
-    adapt(transport: Transport, request: Request): Promise<Request>;
-}
+import { RequestAdapter } from './request-adapter.js';
+/** Flat, ordered composition; adapters may be ordinary objects with an adapt method. */
+export declare class RequestAdapters implements RequestAdapter {
+    readonly adapters: readonly RequestAdapter[];
+    constructor(...adapters: readonly RequestAdapter[]);
+    /** Appends adapters without nesting execution pipelines. */
+    chainTo(...next: readonly RequestAdapter[]): RequestAdapters;
+    adapt(request: Request): Promise<Request>;
+}
+/** @internal Reports the effective signal while keeping invocation state out of the shared chain. */
+export declare function adaptRequest(adapters: readonly RequestAdapter[], request: Request, observeSignal?: (signal: AbortSignal) => void): Promise<Request>;
+/** Composes plain object adapters without requiring inheritance or modifying native prototypes. */
+export declare function chainRequestAdapters(...adapters: readonly RequestAdapter[]): RequestAdapters;

package/build/request-adapters.js

@@ -11,43 +11,52 @@
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and
 // limitations under the License.
-export class HeaderTokenAuthorizingAdapter {
-    header = 'Authorization';
-    tokenHeaderType = 'Bearer';
-    applyToken(request, accessToken) {
-        const requestClone = request.clone();
-        requestClone.headers.set(this.header, `${this.tokenHeaderType} ${accessToken}`);
-        return requestClone;
+import { inheritRequestContext } from './request-context.js';
+import { bodyReads } from './util/owned-body.js';
+import { copyRequest } from './fetch-copy.js';
+import { withAbort, discardBody } from './util/abort.js';
+/** Flat, ordered composition; adapters may be ordinary objects with an adapt method. */
+export class RequestAdapters {
+    adapters;
+    constructor(...adapters) {
+        this.adapters = Object.freeze(adapters.flatMap((adapter) => adapter instanceof RequestAdapters ? adapter.adapters : [adapter]));
     }
-}
-export class StaticHeaderTokenAuthorizingAdapter extends HeaderTokenAuthorizingAdapter {
-    accessToken;
-    constructor(accessToken) {
-        super();
-        this.accessToken = accessToken;
+    /** Appends adapters without nesting execution pipelines. */
+    chainTo(...next) {
+        return new RequestAdapters(this, ...next);
     }
-    async adapt(_transport, request) {
-        return this.applyToken(request, this.accessToken);
+    async adapt(request) {
+        return adaptRequest(this.adapters, request);
     }
 }
-export class RefreshingHeaderTokenAuthorizingAdapter extends HeaderTokenAuthorizingAdapter {
-    refresh;
-    authorization;
-    constructor(refresh) {
-        super();
-        this.refresh = refresh;
-    }
-    shouldRefresh() {
-        if (!this.authorization) {
-            return true;
+/** @internal Reports the effective signal while keeping invocation state out of the shared chain. */
+export async function adaptRequest(adapters, request, observeSignal = () => { }) {
+    let signal = request.signal;
+    try {
+        bodyReads(request);
+        for (const adapter of adapters) {
+            const original = request;
+            request = await withAbort(() => adapter.adapt(request), signal, discardBody);
+            inheritRequestContext(original, request);
+            if (request.signal !== signal)
+                request = copyRequest(request, {
+                    signal: AbortSignal.any([signal, request.signal]),
+                });
+            bodyReads(request);
+            signal = request.signal;
+            observeSignal(signal);
+            signal.throwIfAborted();
         }
-        return this.authorization.expires.getTime() <= Date.now();
+        signal.throwIfAborted();
+        return request;
     }
-    async adapt(transport, request) {
-        if (!this.authorization || this.shouldRefresh()) {
-            this.authorization = await this.refresh(transport);
-        }
-        return this.applyToken(request, this.authorization.token);
+    catch (error) {
+        discardBody(request, error);
+        throw error;
     }
 }
+/** Composes plain object adapters without requiring inheritance or modifying native prototypes. */
+export function chainRequestAdapters(...adapters) {
+    return new RequestAdapters(...adapters);
+}
 //# sourceMappingURL=request-adapters.js.map

package/build/request-adapters.js.map

@@ -1 +1 @@
-{"version":3,"file":"request-adapters.js","sourceRoot":"","sources":["../src/request-adapters.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAC9B,EAAE;AACF,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,gDAAgD;AAChD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AAIjC,MAAM,OAAgB,6BAA6B;IACjD,MAAM,GAAG,eAAe,CAAC;IACzB,eAAe,GAAG,QAAQ,CAAC;IAE3B,UAAU,CAAC,OAAgB,EAAE,WAAmB;QAC9C,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;QACrC,YAAY,CAAC,OAAO,CAAC,GAAG,CACtB,IAAI,CAAC,MAAM,EACX,GAAG,IAAI,CAAC,eAAe,IAAI,WAAW,EAAE,CACzC,CAAC;QACF,OAAO,YAAY,CAAC;IACtB,CAAC;CAMF;AAED,MAAM,OAAO,mCAAoC,SAAQ,6BAA6B;IACvD;IAA7B,YAA6B,WAAmB;QAC9C,KAAK,EAAE,CAAC;QADmB,gBAAW,GAAX,WAAW,CAAQ;IAEhD,CAAC;IAED,KAAK,CAAC,KAAK,CACT,UAAqB,EACrB,OAAgB;QAEhB,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IACpD,CAAC;CACF;AAOD,MAAM,OAAO,uCAAwC,SAAQ,6BAA6B;IAIrE;IAHX,aAAa,CAAsB;IAE3C,YACmB,OAEe;QAEhC,KAAK,EAAE,CAAC;QAJS,YAAO,GAAP,OAAO,CAEQ;IAGlC,CAAC;IAED,aAAa;QACX,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,KAAK,CACT,SAAoB,EACpB,OAAgB;QAEhB,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;YAChD,IAAI,CAAC,aAAa,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC;CACF"}
+{"version":3,"file":"request-adapters.js","sourceRoot":"","sources":["../src/request-adapters.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAC9B,EAAE;AACF,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,gDAAgD;AAChD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AAEjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEzD,wFAAwF;AACxF,MAAM,OAAO,eAAe;IACjB,QAAQ,CAA4B;IAE7C,YAAY,GAAG,QAAmC;QAChD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAC3B,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAC3B,OAAO,YAAY,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAClE,CACF,CAAC;IACJ,CAAC;IAED,4DAA4D;IAC5D,OAAO,CAAC,GAAG,IAA+B;QACxC,OAAO,IAAI,eAAe,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAgB;QAC1B,OAAO,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;CACF;AAED,qGAAqG;AACrG,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAmC,EACnC,OAAgB,EAChB,gBAA+C,GAAG,EAAE,GAAE,CAAC;IAEvD,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC5B,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,CAAC,CAAC;QACnB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC;YACzB,OAAO,GAAG,MAAM,SAAS,CACvB,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAC5B,MAAM,EACN,WAAW,CACZ,CAAC;YACF,qBAAqB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACzC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;gBAC3B,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE;oBAC7B,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;iBAClD,CAAC,CAAC;YACL,SAAS,CAAC,OAAO,CAAC,CAAC;YACnB,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YACxB,aAAa,CAAC,MAAM,CAAC,CAAC;YACtB,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,CAAC;QACD,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5B,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,oBAAoB,CAClC,GAAG,QAAmC;IAEtC,OAAO,IAAI,eAAe,CAAC,GAAG,QAAQ,CAAC,CAAC;AAC1C,CAAC"}

package/build/request-body.d.ts

@@ -0,0 +1,24 @@
+/** Cancellation and memory bound for converting an upload stream into a Blob. */
+export interface RequestBodyBufferOptions {
+    /** Cancels reading and preserves the original abort reason. */
+    signal?: AbortSignal;
+    /** Maximum buffered bytes; defaults to 16 MiB. Does not limit native streaming uploads. */
+    maxBytes?: number;
+}
+/**
+ * Checks runtime support without sending a request. This does not test server/protocol support.
+ * The result is cached for the current runtime's native Fetch implementation.
+ */
+export declare function supportsStreamingUploads(): boolean;
+/**
+ * Prepares a BodyInit before constructing a Request, buffering streams only when unsupported.
+ * Adapters replacing bodies should call this before copyRequest/new Request. Supported streams
+ * retain streaming and receive cooperative cancellation; other bodies pass through unchanged.
+ * This does not confer permission to retry.
+ */
+export declare function prepareRequestBody<T extends BodyInit | null | undefined>(body: T, options?: RequestBodyBufferOptions): Promise<T | Blob | ReadableStream<Uint8Array>>;
+/**
+ * Consumes a byte stream into a bounded Blob. Cancels the source on failure without waiting for
+ * its cleanup, and rethrows the original read error or abort reason. No stream tee or retry occurs.
+ */
+export declare function bufferToBlob(stream: ReadableStream<Uint8Array>, { signal, maxBytes }?: RequestBodyBufferOptions): Promise<Blob>;

package/build/request-body.js

@@ -0,0 +1,104 @@
+// Copyright 2020 Outfox, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+import { ownBody } from './util/owned-body.js';
+let streamingUploadsSupported;
+/**
+ * Checks runtime support without sending a request. This does not test server/protocol support.
+ * The result is cached for the current runtime's native Fetch implementation.
+ */
+export function supportsStreamingUploads() {
+    if (streamingUploadsSupported !== undefined)
+        return streamingUploadsSupported;
+    let duplexAccessed = false;
+    try {
+        const request = new Request('https://localhost/', {
+            method: 'POST',
+            body: new ReadableStream({
+                start(controller) {
+                    controller.close();
+                },
+            }),
+            get duplex() {
+                duplexAccessed = true;
+                return 'half';
+            },
+        });
+        // Bun supports streaming uploads without reading duplex. Firefox instead coerces the
+        // stream to a string and adds Content-Type; older WebKit accepts it but ignores duplex.
+        streamingUploadsSupported =
+            !request.headers.has('Content-Type') &&
+                (duplexAccessed || 'Bun' in globalThis);
+    }
+    catch {
+        streamingUploadsSupported = false;
+    }
+    return streamingUploadsSupported;
+}
+/**
+ * Prepares a BodyInit before constructing a Request, buffering streams only when unsupported.
+ * Adapters replacing bodies should call this before copyRequest/new Request. Supported streams
+ * retain streaming and receive cooperative cancellation; other bodies pass through unchanged.
+ * This does not confer permission to retry.
+ */
+export async function prepareRequestBody(body, options = {}) {
+    if (body instanceof ReadableStream) {
+        if (!supportsStreamingUploads())
+            return bufferToBlob(body, options);
+        const stream = ownBody(body, options.signal);
+        options.signal?.throwIfAborted();
+        return stream;
+    }
+    options.signal?.throwIfAborted();
+    return body;
+}
+/**
+ * Consumes a byte stream into a bounded Blob. Cancels the source on failure without waiting for
+ * its cleanup, and rethrows the original read error or abort reason. No stream tee or retry occurs.
+ */
+export async function bufferToBlob(stream, { signal, maxBytes = 16 * 1024 * 1024 } = {}) {
+    if (!Number.isSafeInteger(maxBytes) || maxBytes < 0) {
+        throw new RangeError('maxBytes must be a non-negative safe integer');
+    }
+    const reader = ownBody(stream, signal).getReader();
+    const parts = [];
+    let size = 0;
+    try {
+        signal?.throwIfAborted();
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (!(value instanceof Uint8Array)) {
+                throw new TypeError('Upload streams must produce Uint8Array chunks');
+            }
+            if (value.byteLength > maxBytes - size) {
+                throw new RangeError(`Buffered request body exceeds ${maxBytes} bytes`);
+            }
+            // Snapshot each chunk before asking the producer for more; it may reuse its buffer.
+            if (value.byteLength)
+                parts.push(new Uint8Array(value));
+            size += value.byteLength;
+        }
+        signal?.throwIfAborted();
+        return new Blob(parts);
+    }
+    catch (error) {
+        void reader.cancel(error).catch(() => undefined);
+        throw error;
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
+//# sourceMappingURL=request-body.js.map

package/build/request-body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-body.js","sourceRoot":"","sources":["../src/request-body.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAC9B,EAAE;AACF,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,gDAAgD;AAChD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AAEjC,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAU/C,IAAI,yBAA8C,CAAC;AAEnD;;;GAGG;AACH,MAAM,UAAU,wBAAwB;IACtC,IAAI,yBAAyB,KAAK,SAAS;QAAE,OAAO,yBAAyB,CAAC;IAC9E,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,oBAAoB,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,cAAc,CAAC;gBACvB,KAAK,CAAC,UAAU;oBACd,UAAU,CAAC,KAAK,EAAE,CAAC;gBACrB,CAAC;aACF,CAAC;YACF,IAAI,MAAM;gBACR,cAAc,GAAG,IAAI,CAAC;gBACtB,OAAO,MAAe,CAAC;YACzB,CAAC;SACa,CAAC,CAAC;QAClB,qFAAqF;QACrF,wFAAwF;QACxF,yBAAyB;YACvB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;gBACpC,CAAC,cAAc,IAAI,KAAK,IAAI,UAAU,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB,GAAG,KAAK,CAAC;IACpC,CAAC;IACD,OAAO,yBAAyB,CAAC;AACnC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAO,EACP,UAAoC,EAAE;IAEtC,IAAI,IAAI,YAAY,cAAc,EAAE,CAAC;QACnC,IAAI,CAAC,wBAAwB,EAAE;YAAE,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7C,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;IACjC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAkC,EAClC,EAAE,MAAM,EAAE,QAAQ,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,KAA+B,EAAE;IAEtE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,UAAU,CAAC,8CAA8C,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,SAAS,EAAE,CAAC;IACnD,MAAM,KAAK,GAA8B,EAAE,CAAC;IAC5C,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,CAAC;QACH,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAC;YACvE,CAAC;YACD,IAAI,KAAK,CAAC,UAAU,GAAG,QAAQ,GAAG,IAAI,EAAE,CAAC;gBACvC,MAAM,IAAI,UAAU,CAAC,iCAAiC,QAAQ,QAAQ,CAAC,CAAC;YAC1E,CAAC;YACD,oFAAoF;YACpF,IAAI,KAAK,CAAC,UAAU;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;YACxD,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;QAC3B,CAAC;QACD,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}

package/build/request-cancellation-error.d.ts

@@ -0,0 +1,13 @@
+/** A runtime marker shared by separate copies of Sunday in the same JavaScript realm. */
+export declare const requestCancellation: unique symbol;
+/** An unconditional stop signal. Sunday rethrows the original instance without retry or reconnect. */
+export declare class RequestCancellationError extends Error {
+    readonly [requestCancellation] = true;
+    constructor(message?: string, options?: ErrorOptions);
+}
+/** Recognizes stop errors, including application errors implementing the exported runtime marker. */
+export declare function isRequestCancellationError(error: unknown): boolean;
+/** Native abort errors also stop an invocation; an absent marker never authorizes a retry. */
+export declare function isRequestStopped(error: unknown): boolean;
+/** @internal Caller cancellation takes precedence without inspecting application error causes. */
+export declare function requestFailure(error: unknown, signal?: AbortSignal): unknown;

package/build/request-cancellation-error.js

@@ -0,0 +1,43 @@
+// Copyright 2020 Outfox, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+/** A runtime marker shared by separate copies of Sunday in the same JavaScript realm. */
+export const requestCancellation = Symbol.for('@outfoxx/sunday/RequestCancellationError');
+/** An unconditional stop signal. Sunday rethrows the original instance without retry or reconnect. */
+export class RequestCancellationError extends Error {
+    [requestCancellation] = true;
+    constructor(message = 'Request cancelled', options) {
+        super(message, options);
+        this.name = 'RequestCancellationError';
+    }
+}
+/** Recognizes stop errors, including application errors implementing the exported runtime marker. */
+export function isRequestCancellationError(error) {
+    return (typeof error === 'object' &&
+        error !== null &&
+        requestCancellation in error &&
+        error[requestCancellation] === true);
+}
+/** Native abort errors also stop an invocation; an absent marker never authorizes a retry. */
+export function isRequestStopped(error) {
+    return (isRequestCancellationError(error) ||
+        (typeof error === 'object' &&
+            error !== null &&
+            'name' in error &&
+            error.name === 'AbortError'));
+}
+/** @internal Caller cancellation takes precedence without inspecting application error causes. */
+export function requestFailure(error, signal) {
+    return signal?.aborted ? signal.reason : error;
+}
+//# sourceMappingURL=request-cancellation-error.js.map

package/build/request-cancellation-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-cancellation-error.js","sourceRoot":"","sources":["../src/request-cancellation-error.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAC9B,EAAE;AACF,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,gDAAgD;AAChD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AAEjC,yFAAyF;AACzF,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAC3C,0CAA0C,CAC3C,CAAC;AAEF,sGAAsG;AACtG,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC;IAEtC,YAAY,OAAO,GAAG,mBAAmB,EAAE,OAAsB;QAC/D,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED,qGAAqG;AACrG,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,mBAAmB,IAAI,KAAK;QAC5B,KAAK,CAAC,mBAAmB,CAAC,KAAK,IAAI,CACpC,CAAC;AACJ,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,CACL,0BAA0B,CAAC,KAAK,CAAC;QACjC,CAAC,OAAO,KAAK,KAAK,QAAQ;YACxB,KAAK,KAAK,IAAI;YACd,MAAM,IAAI,KAAK;YACf,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,CAC/B,CAAC;AACJ,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,cAAc,CAAC,KAAc,EAAE,MAAoB;IACjE,OAAO,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC"}

package/build/request-context.d.ts

@@ -0,0 +1,4 @@
+/** Application-owned metadata retained across Sunday request copies and adapter replacements. */
+export declare function requestContext(request: Request): Map<symbol, unknown>;
+/** @internal Preserve metadata while allowing an adapter to replace its own entries. */
+export declare function inheritRequestContext(source: Request, target: Request): Request;

package/build/request-context.js

@@ -0,0 +1,29 @@
+// Copyright 2020 Outfox, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+const contexts = new WeakMap();
+/** Application-owned metadata retained across Sunday request copies and adapter replacements. */
+export function requestContext(request) {
+    let context = contexts.get(request);
+    if (!context) {
+        context = new Map();
+        contexts.set(request, context);
+    }
+    return context;
+}
+/** @internal Preserve metadata while allowing an adapter to replace its own entries. */
+export function inheritRequestContext(source, target) {
+    contexts.set(target, new Map([...requestContext(source), ...requestContext(target)]));
+    return target;
+}
+//# sourceMappingURL=request-context.js.map

package/build/request-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-context.js","sourceRoot":"","sources":["../src/request-context.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAC9B,EAAE;AACF,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,gDAAgD;AAChD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AAEjC,MAAM,QAAQ,GAAG,IAAI,OAAO,EAAiC,CAAC;AAE9D,iGAAiG;AACjG,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,IAAI,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC;QACpB,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,qBAAqB,CACnC,MAAe,EACf,MAAe;IAEf,QAAQ,CAAC,GAAG,CACV,MAAM,EACN,IAAI,GAAG,CAAC,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAChE,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/build/request-execution.d.ts

@@ -0,0 +1,13 @@
+import { RequestAdapter } from './request-adapter.js';
+import { ResponseAdapter } from './response-adapter.js';
+import { SecurityBinding } from './security-binding.js';
+/** @internal Shared configuration; receipts, cancellation, and retry state belong to each invocation. */
+export declare class RequestExecution {
+    private readonly requests;
+    private readonly responses;
+    constructor(requestAdapter?: RequestAdapter, responseAdapter?: ResponseAdapter);
+    /** Materializes once; the consumer owns the resulting native request and its execution. */
+    export(request: Request, bindings: readonly SecurityBinding[]): Promise<Request>;
+    /** Executes one logical operation, including the caller's body consumption when provided. */
+    execute<T>(prepared: Request, bindings: readonly SecurityBinding[], consume: (response: Response, request: Request) => T | Promise<T>, observeSignal?: (signal: AbortSignal) => void): Promise<T>;
+}

package/build/request-execution.js

@@ -0,0 +1,80 @@
+// Copyright 2020 Outfox, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+import { nativeFetch } from './util/native-fetch.js';
+import { copyRequest } from './fetch-copy.js';
+import { RequestAdapters, adaptRequest } from './request-adapters.js';
+import { ResponseAdapters, adaptResponse } from './response-adapters.js';
+import { setRequestSecurityBindings } from './request-security-bindings.js';
+import { requestFailure } from './request-cancellation-error.js';
+import { discardBody, withAbort } from './util/abort.js';
+/** @internal Shared configuration; receipts, cancellation, and retry state belong to each invocation. */
+export class RequestExecution {
+    requests;
+    responses;
+    constructor(requestAdapter, responseAdapter) {
+        this.requests = new RequestAdapters(...(requestAdapter ? [requestAdapter] : []));
+        this.responses = new ResponseAdapters(...(responseAdapter ? [responseAdapter] : []));
+    }
+    /** Materializes once; the consumer owns the resulting native request and its execution. */
+    async export(request, bindings) {
+        try {
+            setRequestSecurityBindings(request, bindings);
+            return setRequestSecurityBindings(await this.requests.adapt(request), []);
+        }
+        catch (error) {
+            discardBody(request, error);
+            throw error;
+        }
+    }
+    /** Executes one logical operation, including the caller's body consumption when provided. */
+    async execute(prepared, bindings, consume, observeSignal = () => { }) {
+        const controller = new AbortController();
+        let signal = prepared.signal;
+        observeSignal(signal);
+        let sent = prepared;
+        let response;
+        try {
+            signal.throwIfAborted();
+            sent = setRequestSecurityBindings(copyRequest(prepared, { signal }), bindings);
+            sent = await adaptRequest(this.requests.adapters, sent, (effective) => {
+                signal = effective;
+                observeSignal(signal);
+            });
+            // Fetch does not expose intermediate redirect responses in browsers. Credentialed calls
+            // must return the redirect instead of forwarding credentials beyond their selected origin.
+            if (bindings.length ||
+                sent.headers.has('Authorization') ||
+                sent.headers.has('Cookie')) {
+                sent = copyRequest(sent, { redirect: 'manual', credentials: 'omit' });
+            }
+            const request = sent;
+            response = await withAbort(
+            // Keep cleanup cancellation separate from caller/adapter cancellation so an ordinary
+            // network failure remains eligible for the event source's reconnect policy.
+            () => nativeFetch(request, AbortSignal.any([request.signal, controller.signal])), request.signal, discardBody);
+            response = await adaptResponse(this.responses.adapters, response, request, true);
+            const accepted = response;
+            return await withAbort(() => consume(accepted, request), request.signal);
+        }
+        catch (error) {
+            const failure = requestFailure(error, signal);
+            controller.abort(failure);
+            if (response)
+                discardBody(response, failure);
+            discardBody(sent, failure);
+            throw failure;
+        }
+    }
+}
+//# sourceMappingURL=request-execution.js.map

package/build/request-execution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-execution.js","sourceRoot":"","sources":["../src/request-execution.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAC9B,EAAE;AACF,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,gDAAgD;AAChD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AAEjC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAEtE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEjE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEzD,yGAAyG;AACzG,MAAM,OAAO,gBAAgB;IACV,QAAQ,CAAkB;IAC1B,SAAS,CAAmB;IAE7C,YACE,cAA+B,EAC/B,eAAiC;QAEjC,IAAI,CAAC,QAAQ,GAAG,IAAI,eAAe,CACjC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAC5C,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,IAAI,gBAAgB,CACnC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAC9C,CAAC;IACJ,CAAC;IAED,2FAA2F;IAC3F,KAAK,CAAC,MAAM,CACV,OAAgB,EAChB,QAAoC;QAEpC,IAAI,CAAC;YACH,0BAA0B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC9C,OAAO,0BAA0B,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC5B,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,6FAA6F;IAC7F,KAAK,CAAC,OAAO,CACX,QAAiB,EACjB,QAAoC,EACpC,OAAiE,EACjE,gBAA+C,GAAG,EAAE,GAAE,CAAC;QAEvD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,IAAI,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QAC7B,aAAa,CAAC,MAAM,CAAC,CAAC;QACtB,IAAI,IAAI,GAAG,QAAQ,CAAC;QACpB,IAAI,QAA8B,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,CAAC,cAAc,EAAE,CAAC;YACxB,IAAI,GAAG,0BAA0B,CAC/B,WAAW,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,EACjC,QAAQ,CACT,CAAC;YACF,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,EAAE;gBACpE,MAAM,GAAG,SAAS,CAAC;gBACnB,aAAa,CAAC,MAAM,CAAC,CAAC;YACxB,CAAC,CAAC,CAAC;YACH,wFAAwF;YACxF,2FAA2F;YAC3F,IACE,QAAQ,CAAC,MAAM;gBACf,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;gBACjC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAC1B,CAAC;gBACD,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC;YACrB,QAAQ,GAAG,MAAM,SAAS;YACxB,qFAAqF;YACrF,4EAA4E;YAC5E,GAAG,EAAE,CACH,WAAW,CACT,OAAO,EACP,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CACrD,EACH,OAAO,CAAC,MAAM,EACd,WAAW,CACZ,CAAC;YACF,QAAQ,GAAG,MAAM,aAAa,CAC5B,IAAI,CAAC,SAAS,CAAC,QAAQ,EACvB,QAAQ,EACR,OAAO,EACP,IAAI,CACL,CAAC;YACF,MAAM,QAAQ,GAAG,QAAQ,CAAC;YAC1B,OAAO,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC9C,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC1B,IAAI,QAAQ;gBAAE,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC7C,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC3B,MAAM,OAAO,CAAC;QAChB,CAAC;IACH,CAAC;CACF"}

package/build/request-security-bindings.d.ts

@@ -0,0 +1,5 @@
+import type { SecurityBinding } from './security-binding.js';
+/** Returns operation security metadata for application-owned HTTP adapters, without token state. */
+export declare function requestSecurityBindings(request: Request): readonly SecurityBinding[];
+/** @internal Snapshots metadata without adding wire headers or credential receipts. */
+export declare function setRequestSecurityBindings(request: Request, values: readonly SecurityBinding[]): Request;

package/build/request-security-bindings.js

@@ -0,0 +1,30 @@
+// Copyright 2020 Outfox, Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+import { requestContext } from './request-context.js';
+const bindings = Symbol('operationSecurityBindings');
+const empty = Object.freeze([]);
+/** Returns operation security metadata for application-owned HTTP adapters, without token state. */
+export function requestSecurityBindings(request) {
+    return (requestContext(request).get(bindings) ?? empty);
+}
+/** @internal Snapshots metadata without adding wire headers or credential receipts. */
+export function setRequestSecurityBindings(request, values) {
+    requestContext(request).set(bindings, Object.freeze(values.map((value) => Object.freeze({
+        ...value,
+        scopes: Object.freeze([...value.scopes]),
+        transport: Object.freeze({ ...value.transport }),
+    }))));
+    return request;
+}
+//# sourceMappingURL=request-security-bindings.js.map

package/build/request-security-bindings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-security-bindings.js","sourceRoot":"","sources":["../src/request-security-bindings.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAC9B,EAAE;AACF,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,gDAAgD;AAChD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AAIjC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,MAAM,QAAQ,GAAG,MAAM,CAAC,2BAA2B,CAAC,CAAC;AACrD,MAAM,KAAK,GAA+B,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE5D,oGAAoG;AACpG,MAAM,UAAU,uBAAuB,CACrC,OAAgB;IAEhB,OAAO,CACJ,cAAc,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,QAAQ,CAEvB,IAAI,KAAK,CACxB,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,0BAA0B,CACxC,OAAgB,EAChB,MAAkC;IAElC,cAAc,CAAC,OAAO,CAAC,CAAC,GAAG,CACzB,QAAQ,EACR,MAAM,CAAC,MAAM,CACX,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACnB,MAAM,CAAC,MAAM,CAAC;QACZ,GAAG,KAAK;QACR,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QACxC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;KACjD,CAAC,CACH,CACF,CACF,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/build/request-security.d.ts

@@ -0,0 +1,20 @@
+import { SecurityBinding } from './security-binding.js';
+import { TokenLease } from './token-manager.js';
+import { TokenProvider } from './token-provider.js';
+/** Per-request credentials, retained only for conditional invalidation and bounded recovery. */
+export interface AuthorizedRequest {
+    readonly request: Request;
+    readonly bindings: readonly SecurityBinding[];
+    readonly leases: readonly TokenLease[];
+}
+/** Adds all credentials atomically after every provider succeeds. */
+export declare function authorizeRequest(request: Request, bindings: readonly SecurityBinding[], providers: Readonly<Record<string, TokenProvider>>, maxBufferedRequestBytes?: number): Promise<AuthorizedRequest>;
+/** Recognizes explicit rejection of the bearer credential sent on this request. */
+export declare function isBearerTokenRejection(request: Request, response: Response): boolean;
+/** Returns only bearer receipts rejected by an invalid-token challenge, preserving other conjuncts. */
+export declare function rejectedBearerLeases(request: AuthorizedRequest): readonly TokenLease[];
+/** Removes query credentials from responses before error translation or diagnostic rendering. */
+export declare function redactSecurityResponse(response: Response, bindings: readonly SecurityBinding[]): Response;
+export declare function hasInvalidBearerChallenge(header: string): boolean;
+/** Reports all matching rejections, including unsafe requests and exhausted recovery budgets. */
+export declare function rejectCredentials(request: AuthorizedRequest, response: Response): Promise<void>;