@peakflo/agent-harness 0.0.0-stage → 0.2.1-rc.3

package/dist/control-plane.d.ts

@@ -0,0 +1,178 @@
+import { ControlPlaneErrorBody, CredentialRotateResponse, DeregisterResponse, IngestRequest, IngestResponse, LeaseRenewResponse, LeaseResponse, RunnerCapabilities, RunnerHeartbeatResponse, RunnerRegisterResponse, RunnerRuntime, RunnerStatus, SessionHistoryResponse } from './types';
+export declare class ControlPlaneError extends Error {
+    readonly status: number;
+    /** The stable machine-readable code from the body, when the server sent one. */
+    readonly code?: string;
+    /** The floor an operator needs to see on a protocol refusal. */
+    readonly minProtocolVersion?: number;
+    readonly minHarnessVersion?: string;
+    constructor(message: string, status: number, body?: ControlPlaneErrorBody);
+    /**
+     * Is retrying this pointless?
+     *
+     * Delegates to the SHARED predicate rather than inlining a status list. The
+     * Phase 0 skeleton inlined [400, 401, 403, 404, 409] and so did not treat
+     * 426 Upgrade Required as final — which meant the RUNNING-FLEET version gate
+     * never took effect: a below-floor harness retried for ever instead of
+     * exiting. Import the constant; never retype the list.
+     */
+    get final(): boolean;
+}
+/**
+ * A 426 at heartbeat, lease or ingest. The control plane raised its floor under
+ * a runner that was already registered.
+ *
+ * A distinct class rather than a message match, so rewording an error string
+ * cannot quietly turn a fail-fast into a retry loop.
+ */
+export declare class ProtocolRefusedError extends ControlPlaneError {
+    constructor(message: string, body?: ControlPlaneErrorBody);
+}
+export interface RegisterInput {
+    enrolmentToken: string;
+    capabilities: RunnerCapabilities;
+    runtime: RunnerRuntime;
+    degraded: boolean;
+    degradedReason?: string;
+}
+export interface HeartbeatInput {
+    status: RunnerStatus;
+    uptimeMs: number;
+    activeSessions: number;
+    activeSessionIds?: string[];
+    degraded: boolean;
+    capabilities: RunnerCapabilities;
+}
+export interface ControlPlaneClientOptions {
+    /** Injected in tests. Defaults to the global fetch. */
+    fetchImpl?: typeof fetch;
+    /** Injected in tests so back-off does not cost real wall-clock. */
+    sleepImpl?: (ms: number) => Promise<void>;
+    maxAttempts?: number;
+    baseDelayMs?: number;
+}
+export interface IsolatedLeaseRenewalConfig {
+    url: string;
+    runnerCredential: string;
+}
+/**
+ * THE OUTBOUND CONTROL-PLANE CLIENT.
+ *
+ * Every method here DIALS OUT. There is no server, no listener and no inverse
+ * channel, and there must never be one: the moment the control plane needs to
+ * dial a runner, a customer VM behind NAT stops working without a tunnel. Work
+ * arrives on `lease()`, a bounded long-poll; anything that must reach a RUNNING
+ * session — an abort, a user's answer — rides back on the next `heartbeat()`.
+ *
+ * The runner credential lives in this object and NOWHERE ELSE. It is never
+ * written to disk, never handed to a session process and never placed in argv.
+ */
+export declare class ControlPlaneClient {
+    private readonly baseUrl;
+    private readonly fetchImpl;
+    private readonly sleepImpl;
+    private readonly maxAttempts;
+    private readonly baseDelayMs;
+    private runnerCredential;
+    private runnerId;
+    constructor(controlPlaneUrl: string, options?: ControlPlaneClientOptions);
+    /** True once a real, non-empty runner credential is held. */
+    isRegistered(): boolean;
+    /** Used only for a private IPC handoff to the baked sandbox supervisor. */
+    getRunnerCredential(): string | null;
+    getRunnerId(): string | null;
+    /**
+     * Give the lease-renewal worker the minimum information it needs.
+     *
+     * The worker owns only this one authenticated route. It cannot lease work,
+     * ingest a transcript, or call an integration. A custom fetch implementation
+     * means a test or embedded host owns transport, so those clients keep using
+     * the in-process renewer.
+     */
+    isolatedLeaseRenewalConfig(): IsolatedLeaseRenewalConfig | null;
+    /**
+     * Install a PERSISTED runner credential without going through enrolment.
+     *
+     * This is the reuse half of durable credential storage: a self-hosted or
+     * desktop harness that crashed and restarted loads its stored credential and
+     * installs it here, so `heartbeat`, `lease` and `ingest` authenticate exactly
+     * as they would after a fresh `register`. The credential is validated by the
+     * first authenticated call; a rejected one is dropped by the caller and
+     * enrolment is retried. See `credential-store.ts`.
+     */
+    useStoredCredential(runnerId: string, credential: string): void;
+    /** Drop the in-memory credential. Called on shutdown. */
+    forgetCredential(): void;
+    /**
+     * Exchange the enrolment token for a long-lived runner credential.
+     *
+     * Retries with exponential back-off, because a control plane that is briefly
+     * unreachable must not kill a host that has already booted. A FINAL status
+     * is never retried: a spent enrolment token would otherwise burn six attempts
+     * over ~31 seconds before failing with the same answer.
+     */
+    register(input: RegisterInput): Promise<RunnerRegisterResponse>;
+    /**
+     * Liveness plus capability refresh, and the ONLY inbound-shaped channel the
+     * contract has: `sessionCommands` on the response is how an abort or an
+     * answer to a question reaches a running session without anything dialling in.
+     */
+    heartbeat(input: HeartbeatInput): Promise<RunnerHeartbeatResponse>;
+    /**
+     * The bounded long-poll that replaces a socket.
+     *
+     * Returns null on 204 (no work) — poll again immediately. NOT retried here:
+     * the caller's loop IS the retry, and layering back-off inside a poll that is
+     * already bounded would only make a runner slower to pick work up.
+     *
+     * The client timeout is `wait + slack`, never the flat request timeout — a
+     * 25s poll under a 15s timeout would abort every single call.
+     */
+    lease(waitSeconds?: number): Promise<LeaseResponse | null>;
+    renewLease(leaseId: string, status?: RunnerStatus, githubTokenExpiresAt?: string, modelTokenExpiresAt?: string): Promise<LeaseRenewResponse>;
+    /**
+     * THE RUNTIME-NEUTRAL ROUTE. A Daytona sandbox, a customer VM and the 20x
+     * desktop all call exactly this.
+     *
+     * Retried with back-off, because losing transcript to a transient blip is a
+     * visible product defect — the user watches text stop arriving. Retrying is
+     * safe: the upsert is keyed on (sessionId, partId), so a replayed batch is
+     * idempotent.
+     */
+    ingest(sessionId: string, request: Omit<IngestRequest, 'protocolVersion'>): Promise<IngestResponse>;
+    /**
+     * Read the session's model-facing conversation back from the control plane.
+     *
+     * Called only when this runner does not already hold the conversation — see
+     * `SessionRunner.loadMemory`, which uses `resumeFromRev` to decide. NOT
+     * retried on the shared retry ladder: it is on the critical path of a turn
+     * the user is watching, and the caller already degrades gracefully to
+     * whatever it holds locally rather than failing the turn.
+     */
+    sessionHistory(sessionId: string, leaseId: string): Promise<SessionHistoryResponse>;
+    /**
+     * Authenticated with the CURRENT credential, which is why a harness must
+     * rotate ON SCHEDULE (`rotateAfter`) and must NOT try to rotate its way out
+     * of a 401. An expired credential cannot authenticate its own replacement,
+     * so a harness that tried would loop between two routes that can only fail.
+     */
+    rotateCredential(harnessVersion: string): Promise<CredentialRotateResponse>;
+    /**
+     * A polite goodbye, and the one route that must never block a shutdown. A
+     * failure here is logged by the caller and ignored: liveness is the 30s
+     * heartbeat, and the watchdog requeues in-flight leases regardless.
+     */
+    deregister(reason?: string, hadActiveSessions?: boolean): Promise<DeregisterResponse>;
+    private requireCredential;
+    private requireRunnerId;
+    /**
+     * Exponential back-off, capped by attempt count rather than by wall clock so
+     * that a caller can reason about the worst case: ~31s at the defaults.
+     *
+     * A FINAL status short-circuits immediately. That is the whole reason
+     * `FINAL_HTTP_STATUSES` is shared with the control plane instead of being
+     * retyped on each side.
+     */
+    private withRetry;
+    private send;
+}

package/dist/control-plane.js

@@ -0,0 +1,431 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ControlPlaneClient = exports.ProtocolRefusedError = exports.ControlPlaneError = void 0;
+const contract_1 = require("./contract");
+/**
+ * Default request timeout. Deliberately NOT applied to the lease long-poll,
+ * which is bounded by its own `wait` and gets `wait + slack`.
+ */
+const REQUEST_TIMEOUT_MS = 15_000;
+/** Slack over the requested lease wait before the client gives up on its own. */
+const LEASE_TIMEOUT_SLACK_MS = 10_000;
+function safeParse(text) {
+    if (!text) {
+        return undefined;
+    }
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        // A non-JSON error body is perfectly possible from a proxy. The STATUS is
+        // what the retry decision rests on, so an unparseable body costs nothing.
+        return undefined;
+    }
+}
+class ControlPlaneError extends Error {
+    status;
+    /** The stable machine-readable code from the body, when the server sent one. */
+    code;
+    /** The floor an operator needs to see on a protocol refusal. */
+    minProtocolVersion;
+    minHarnessVersion;
+    constructor(message, status, body) {
+        super(message);
+        this.name = 'ControlPlaneError';
+        this.status = status;
+        this.code = body?.code;
+        this.minProtocolVersion = body?.minProtocolVersion;
+        this.minHarnessVersion = body?.minHarnessVersion;
+    }
+    /**
+     * Is retrying this pointless?
+     *
+     * Delegates to the SHARED predicate rather than inlining a status list. The
+     * Phase 0 skeleton inlined [400, 401, 403, 404, 409] and so did not treat
+     * 426 Upgrade Required as final — which meant the RUNNING-FLEET version gate
+     * never took effect: a below-floor harness retried for ever instead of
+     * exiting. Import the constant; never retype the list.
+     */
+    get final() {
+        return (0, contract_1.isFinalStatus)(this.status);
+    }
+}
+exports.ControlPlaneError = ControlPlaneError;
+/**
+ * A 426 at heartbeat, lease or ingest. The control plane raised its floor under
+ * a runner that was already registered.
+ *
+ * A distinct class rather than a message match, so rewording an error string
+ * cannot quietly turn a fail-fast into a retry loop.
+ */
+class ProtocolRefusedError extends ControlPlaneError {
+    constructor(message, body) {
+        super(message, 426, body);
+        this.name = 'ProtocolRefusedError';
+    }
+}
+exports.ProtocolRefusedError = ProtocolRefusedError;
+function sleep(ms) {
+    return new Promise((resolve) => {
+        setTimeout(resolve, ms);
+    });
+}
+/**
+ * THE OUTBOUND CONTROL-PLANE CLIENT.
+ *
+ * Every method here DIALS OUT. There is no server, no listener and no inverse
+ * channel, and there must never be one: the moment the control plane needs to
+ * dial a runner, a customer VM behind NAT stops working without a tunnel. Work
+ * arrives on `lease()`, a bounded long-poll; anything that must reach a RUNNING
+ * session — an abort, a user's answer — rides back on the next `heartbeat()`.
+ *
+ * The runner credential lives in this object and NOWHERE ELSE. It is never
+ * written to disk, never handed to a session process and never placed in argv.
+ */
+class ControlPlaneClient {
+    baseUrl;
+    fetchImpl;
+    sleepImpl;
+    maxAttempts;
+    baseDelayMs;
+    runnerCredential = null;
+    runnerId = null;
+    constructor(controlPlaneUrl, options = {}) {
+        this.baseUrl = controlPlaneUrl.replace(/\/+$/, '');
+        this.fetchImpl = options.fetchImpl ?? fetch;
+        this.sleepImpl = options.sleepImpl ?? sleep;
+        this.maxAttempts = options.maxAttempts ?? contract_1.DEFAULT_MAX_ATTEMPTS;
+        this.baseDelayMs = options.baseDelayMs ?? contract_1.DEFAULT_BASE_DELAY_MS;
+    }
+    /* ------------------------------------------------------------------ */
+    /* Identity                                                            */
+    /* ------------------------------------------------------------------ */
+    /** True once a real, non-empty runner credential is held. */
+    isRegistered() {
+        return (typeof this.runnerCredential === 'string' &&
+            this.runnerCredential.length > 0 &&
+            typeof this.runnerId === 'string' &&
+            this.runnerId.length > 0);
+    }
+    /** Used only for a private IPC handoff to the baked sandbox supervisor. */
+    getRunnerCredential() {
+        return this.runnerCredential;
+    }
+    getRunnerId() {
+        return this.runnerId;
+    }
+    /**
+     * Give the lease-renewal worker the minimum information it needs.
+     *
+     * The worker owns only this one authenticated route. It cannot lease work,
+     * ingest a transcript, or call an integration. A custom fetch implementation
+     * means a test or embedded host owns transport, so those clients keep using
+     * the in-process renewer.
+     */
+    isolatedLeaseRenewalConfig() {
+        if (this.fetchImpl !== fetch || !this.runnerId || !this.runnerCredential) {
+            return null;
+        }
+        return {
+            url: `${this.baseUrl}${contract_1.ROUTES.leaseRenew(this.runnerId, '__LEASE_ID__')}`,
+            runnerCredential: this.runnerCredential
+        };
+    }
+    /**
+     * Install a PERSISTED runner credential without going through enrolment.
+     *
+     * This is the reuse half of durable credential storage: a self-hosted or
+     * desktop harness that crashed and restarted loads its stored credential and
+     * installs it here, so `heartbeat`, `lease` and `ingest` authenticate exactly
+     * as they would after a fresh `register`. The credential is validated by the
+     * first authenticated call; a rejected one is dropped by the caller and
+     * enrolment is retried. See `credential-store.ts`.
+     */
+    useStoredCredential(runnerId, credential) {
+        this.runnerId = runnerId;
+        this.runnerCredential = credential;
+    }
+    /** Drop the in-memory credential. Called on shutdown. */
+    forgetCredential() {
+        this.runnerCredential = null;
+    }
+    /* ------------------------------------------------------------------ */
+    /* 1. register                                                         */
+    /* ------------------------------------------------------------------ */
+    /**
+     * Exchange the enrolment token for a long-lived runner credential.
+     *
+     * Retries with exponential back-off, because a control plane that is briefly
+     * unreachable must not kill a host that has already booted. A FINAL status
+     * is never retried: a spent enrolment token would otherwise burn six attempts
+     * over ~31 seconds before failing with the same answer.
+     */
+    async register(input) {
+        const response = await this.withRetry('register', () => this.send({
+            method: 'POST',
+            path: contract_1.ROUTES.register(),
+            token: input.enrolmentToken,
+            body: {
+                protocolVersion: contract_1.PROTOCOL_VERSION,
+                capabilities: input.capabilities,
+                runtime: input.runtime,
+                degraded: input.degraded,
+                degradedReason: input.degradedReason
+            }
+        }));
+        // THE VERSION GATE MUST FAIL CLOSED.
+        //
+        // Testing only `accepted === false` fails OPEN when a 200 omits the field.
+        // A successful registration always carries BOTH a credential and a runner
+        // id, so those are the real invariant: no credential means not accepted,
+        // whatever the response says about itself.
+        const credential = typeof response.runnerCredential === 'string' &&
+            response.runnerCredential.length > 0
+            ? response.runnerCredential
+            : null;
+        const id = typeof response.runnerId === 'string' && response.runnerId.length > 0
+            ? response.runnerId
+            : null;
+        if (response.accepted === false || !credential || !id) {
+            this.runnerCredential = null;
+            this.runnerId = null;
+            return response;
+        }
+        this.runnerCredential = credential;
+        this.runnerId = id;
+        return response;
+    }
+    /* ------------------------------------------------------------------ */
+    /* 2. heartbeat                                                        */
+    /* ------------------------------------------------------------------ */
+    /**
+     * Liveness plus capability refresh, and the ONLY inbound-shaped channel the
+     * contract has: `sessionCommands` on the response is how an abort or an
+     * answer to a question reaches a running session without anything dialling in.
+     */
+    async heartbeat(input) {
+        const runnerId = this.requireRunnerId();
+        const body = {
+            protocolVersion: contract_1.PROTOCOL_VERSION,
+            status: input.status,
+            uptimeMs: input.uptimeMs,
+            activeSessions: input.activeSessions,
+            activeSessionIds: input.activeSessionIds,
+            degraded: input.degraded,
+            capabilities: input.capabilities
+        };
+        return this.send({
+            method: 'POST',
+            path: contract_1.ROUTES.heartbeat(runnerId),
+            token: this.requireCredential(),
+            body
+        });
+    }
+    /* ------------------------------------------------------------------ */
+    /* 3. lease                                                            */
+    /* ------------------------------------------------------------------ */
+    /**
+     * The bounded long-poll that replaces a socket.
+     *
+     * Returns null on 204 (no work) — poll again immediately. NOT retried here:
+     * the caller's loop IS the retry, and layering back-off inside a poll that is
+     * already bounded would only make a runner slower to pick work up.
+     *
+     * The client timeout is `wait + slack`, never the flat request timeout — a
+     * 25s poll under a 15s timeout would abort every single call.
+     */
+    async lease(waitSeconds = contract_1.DEFAULT_LEASE_WAIT_SECONDS) {
+        const runnerId = this.requireRunnerId();
+        const path = contract_1.ROUTES.lease(runnerId, waitSeconds);
+        const result = await this.send({
+            method: 'GET',
+            path,
+            token: this.requireCredential(),
+            timeoutMs: waitSeconds * 1_000 + LEASE_TIMEOUT_SLACK_MS
+        });
+        return result;
+    }
+    /* ------------------------------------------------------------------ */
+    /* 4. lease renew                                                      */
+    /* ------------------------------------------------------------------ */
+    async renewLease(leaseId, status, githubTokenExpiresAt, modelTokenExpiresAt) {
+        const runnerId = this.requireRunnerId();
+        return this.send({
+            method: 'POST',
+            path: contract_1.ROUTES.leaseRenew(runnerId, leaseId),
+            token: this.requireCredential(),
+            body: {
+                protocolVersion: contract_1.PROTOCOL_VERSION,
+                status,
+                githubTokenExpiresAt,
+                modelTokenExpiresAt
+            }
+        });
+    }
+    /* ------------------------------------------------------------------ */
+    /* 5. ingest                                                           */
+    /* ------------------------------------------------------------------ */
+    /**
+     * THE RUNTIME-NEUTRAL ROUTE. A Daytona sandbox, a customer VM and the 20x
+     * desktop all call exactly this.
+     *
+     * Retried with back-off, because losing transcript to a transient blip is a
+     * visible product defect — the user watches text stop arriving. Retrying is
+     * safe: the upsert is keyed on (sessionId, partId), so a replayed batch is
+     * idempotent.
+     */
+    async ingest(sessionId, request) {
+        return this.withRetry('ingest', () => this.send({
+            method: 'POST',
+            path: contract_1.ROUTES.ingest(sessionId),
+            token: this.requireCredential(),
+            body: { protocolVersion: contract_1.PROTOCOL_VERSION, ...request }
+        }));
+    }
+    /* ------------------------------------------------------------------ */
+    /* 5b. session history — the runner's READ path                        */
+    /* ------------------------------------------------------------------ */
+    /**
+     * Read the session's model-facing conversation back from the control plane.
+     *
+     * Called only when this runner does not already hold the conversation — see
+     * `SessionRunner.loadMemory`, which uses `resumeFromRev` to decide. NOT
+     * retried on the shared retry ladder: it is on the critical path of a turn
+     * the user is watching, and the caller already degrades gracefully to
+     * whatever it holds locally rather than failing the turn.
+     */
+    async sessionHistory(sessionId, leaseId) {
+        return this.send({
+            method: 'GET',
+            path: contract_1.ROUTES.sessionHistory(sessionId, leaseId),
+            token: this.requireCredential()
+        });
+    }
+    /* ------------------------------------------------------------------ */
+    /* 6. credential rotate                                                */
+    /* ------------------------------------------------------------------ */
+    /**
+     * Authenticated with the CURRENT credential, which is why a harness must
+     * rotate ON SCHEDULE (`rotateAfter`) and must NOT try to rotate its way out
+     * of a 401. An expired credential cannot authenticate its own replacement,
+     * so a harness that tried would loop between two routes that can only fail.
+     */
+    async rotateCredential(harnessVersion) {
+        const runnerId = this.requireRunnerId();
+        const response = await this.send({
+            method: 'POST',
+            path: contract_1.ROUTES.credentialRotate(runnerId),
+            token: this.requireCredential(),
+            body: { protocolVersion: contract_1.PROTOCOL_VERSION, harnessVersion }
+        });
+        if (typeof response.runnerCredential === 'string' &&
+            response.runnerCredential.length > 0) {
+            this.runnerCredential = response.runnerCredential;
+        }
+        return response;
+    }
+    /* ------------------------------------------------------------------ */
+    /* 7. deregister                                                       */
+    /* ------------------------------------------------------------------ */
+    /**
+     * A polite goodbye, and the one route that must never block a shutdown. A
+     * failure here is logged by the caller and ignored: liveness is the 30s
+     * heartbeat, and the watchdog requeues in-flight leases regardless.
+     */
+    async deregister(reason, hadActiveSessions) {
+        const runnerId = this.requireRunnerId();
+        return this.send({
+            method: 'POST',
+            path: contract_1.ROUTES.deregister(runnerId),
+            token: this.requireCredential(),
+            body: { protocolVersion: contract_1.PROTOCOL_VERSION, reason, hadActiveSessions }
+        });
+    }
+    /* ------------------------------------------------------------------ */
+    /* Plumbing                                                            */
+    /* ------------------------------------------------------------------ */
+    requireCredential() {
+        if (!this.runnerCredential) {
+            throw new ControlPlaneError('Not registered', 401, {
+                error: 'Not registered',
+                code: contract_1.CONTRACT_ERROR_CODES.credentialInvalid
+            });
+        }
+        return this.runnerCredential;
+    }
+    requireRunnerId() {
+        if (!this.runnerId) {
+            throw new ControlPlaneError('Not registered', 401, {
+                error: 'Not registered',
+                code: contract_1.CONTRACT_ERROR_CODES.runnerUnknown
+            });
+        }
+        return this.runnerId;
+    }
+    /**
+     * Exponential back-off, capped by attempt count rather than by wall clock so
+     * that a caller can reason about the worst case: ~31s at the defaults.
+     *
+     * A FINAL status short-circuits immediately. That is the whole reason
+     * `FINAL_HTTP_STATUSES` is shared with the control plane instead of being
+     * retyped on each side.
+     */
+    async withRetry(label, attemptFn) {
+        let lastError;
+        for (let attempt = 1; attempt <= this.maxAttempts; attempt += 1) {
+            try {
+                return await attemptFn();
+            }
+            catch (error) {
+                lastError = error;
+                if (error instanceof ControlPlaneError && error.final) {
+                    throw error;
+                }
+                if (attempt < this.maxAttempts) {
+                    await this.sleepImpl(this.baseDelayMs * 2 ** (attempt - 1));
+                }
+            }
+        }
+        throw lastError instanceof Error ? lastError : new Error(`${label} failed`);
+    }
+    async send(input) {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), input.timeoutMs ?? REQUEST_TIMEOUT_MS);
+        try {
+            const headers = {
+                Authorization: `Bearer ${input.token}`,
+                // An OPTIONAL echo of the body's protocolVersion, so a proxy or an
+                // access log can see the version without parsing JSON. THE BODY STAYS
+                // AUTHORITATIVE; a server that finds the two disagreeing must refuse.
+                [contract_1.PROTOCOL_VERSION_HEADER]: String(contract_1.PROTOCOL_VERSION)
+            };
+            if (input.body !== undefined) {
+                headers['Content-Type'] = 'application/json';
+            }
+            const response = await this.fetchImpl(`${this.baseUrl}${input.path}`, {
+                method: input.method,
+                headers,
+                body: input.body === undefined ? undefined : JSON.stringify(input.body),
+                signal: controller.signal
+            });
+            // 204 is a real answer on the lease route: "no work, poll again". It is
+            // not an error and must not be parsed as a body.
+            if (response.status === 204) {
+                return null;
+            }
+            const text = await response.text();
+            if (!response.ok) {
+                const parsed = safeParse(text);
+                const message = `${input.path} returned ${response.status}: ${text.slice(0, 400)}`;
+                throw response.status === 426
+                    ? new ProtocolRefusedError(message, parsed)
+                    : new ControlPlaneError(message, response.status, parsed);
+            }
+            return (text ? JSON.parse(text) : {});
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+}
+exports.ControlPlaneClient = ControlPlaneClient;