@superdurable/connector-docusign 0.0.0-stage → 0.1.0

package/dist/index.js

@@ -0,0 +1,1270 @@
+import {
+  CombinedDocumentSchema,
+  ConfigSchema,
+  Connection,
+  ConnectorID,
+  CreateEnvelopeFromTemplateBranch,
+  CreateEnvelopeFromTemplateBranchCreated,
+  CreateEnvelopeFromTemplateBranchDefect,
+  CreateEnvelopeFromTemplateBranchProviderRejected,
+  CreateEnvelopeFromTemplateBranchUncertain,
+  CreateEnvelopeFromTemplateDefinition,
+  CreateEnvelopeFromTemplateInputSchema,
+  CreateEnvelopeFromTemplateMetadata,
+  CreatedEnvelopeSchema,
+  DownloadCombinedDocumentBranch,
+  DownloadCombinedDocumentBranchDefect,
+  DownloadCombinedDocumentBranchDownloaded,
+  DownloadCombinedDocumentBranchInvalidResponse,
+  DownloadCombinedDocumentBranchNotFound,
+  DownloadCombinedDocumentBranchProviderRejected,
+  DownloadCombinedDocumentBranchTooLarge,
+  DownloadCombinedDocumentDefinition,
+  DownloadCombinedDocumentInputSchema,
+  DownloadCombinedDocumentMetadata,
+  EnvelopeCustomFieldSchema,
+  EnvelopeRecipientsSchema,
+  EnvelopeSchema,
+  GetEnvelopeBranch,
+  GetEnvelopeBranchDefect,
+  GetEnvelopeBranchFound,
+  GetEnvelopeBranchInvalidResponse,
+  GetEnvelopeBranchNotFound,
+  GetEnvelopeBranchProviderRejected,
+  GetEnvelopeDefinition,
+  GetEnvelopeInputSchema,
+  GetEnvelopeMetadata,
+  ListEnvelopeRecipientsBranch,
+  ListEnvelopeRecipientsBranchDefect,
+  ListEnvelopeRecipientsBranchInvalidResponse,
+  ListEnvelopeRecipientsBranchListed,
+  ListEnvelopeRecipientsBranchNotFound,
+  ListEnvelopeRecipientsBranchProviderRejected,
+  ListEnvelopeRecipientsDefinition,
+  ListEnvelopeRecipientsInputSchema,
+  ListEnvelopeRecipientsMetadata,
+  ProviderID,
+  RecipientSchema,
+  TemplateRoleSchema,
+  VoidEnvelopeBranch,
+  VoidEnvelopeBranchDefect,
+  VoidEnvelopeBranchInvalidResponse,
+  VoidEnvelopeBranchNotFound,
+  VoidEnvelopeBranchNotVoidable,
+  VoidEnvelopeBranchProviderRejected,
+  VoidEnvelopeBranchVoided,
+  VoidEnvelopeDefinition,
+  VoidEnvelopeInputSchema,
+  VoidEnvelopeMetadata,
+  VoidedEnvelopeSchema,
+  decodeCredentials,
+  decodeSharedCredentials,
+  newConnection,
+  newConnectionWithOperations,
+  newProjectConnection,
+  newProjectCredentialProvider
+} from "./chunk-42O7OZRV.js";
+
+// src/generated/steps.ts
+import { goToBranch, newMutationStep, newQueryStep } from "@superdurable/connectors-sdk";
+function newCreateEnvelopeFromTemplateStep(configuration) {
+  const { connection, connectionName, created, providerRejected, uncertain, defect, ...stepConfiguration } = configuration;
+  if (!connection || connection.reference.name !== connectionName) throw new TypeError("Step connection name differs from the bound connection");
+  return newMutationStep({ ...stepConfiguration, operation: connection.operations.createEnvelopeFromTemplate(), connection: connection.reference, branches: [
+    goToBranch("created", created),
+    ...providerRejected ? [goToBranch("providerRejected", providerRejected)] : [],
+    ...uncertain ? [goToBranch("uncertain", uncertain)] : [],
+    ...defect ? [goToBranch("defect", defect)] : []
+  ] });
+}
+function newGetEnvelopeStep(configuration) {
+  const { connection, connectionName, found, notFound, providerRejected, invalidResponse, defect, ...stepConfiguration } = configuration;
+  if (!connection || connection.reference.name !== connectionName) throw new TypeError("Step connection name differs from the bound connection");
+  return newQueryStep({ ...stepConfiguration, operation: connection.operations.getEnvelope(), connection: connection.reference, branches: [
+    goToBranch("found", found),
+    ...notFound ? [goToBranch("notFound", notFound)] : [],
+    ...providerRejected ? [goToBranch("providerRejected", providerRejected)] : [],
+    ...invalidResponse ? [goToBranch("invalidResponse", invalidResponse)] : [],
+    ...defect ? [goToBranch("defect", defect)] : []
+  ] });
+}
+function newListEnvelopeRecipientsStep(configuration) {
+  const { connection, connectionName, listed, notFound, providerRejected, invalidResponse, defect, ...stepConfiguration } = configuration;
+  if (!connection || connection.reference.name !== connectionName) throw new TypeError("Step connection name differs from the bound connection");
+  return newQueryStep({ ...stepConfiguration, operation: connection.operations.listEnvelopeRecipients(), connection: connection.reference, branches: [
+    goToBranch("listed", listed),
+    ...notFound ? [goToBranch("notFound", notFound)] : [],
+    ...providerRejected ? [goToBranch("providerRejected", providerRejected)] : [],
+    ...invalidResponse ? [goToBranch("invalidResponse", invalidResponse)] : [],
+    ...defect ? [goToBranch("defect", defect)] : []
+  ] });
+}
+function newVoidEnvelopeStep(configuration) {
+  const { connection, connectionName, voided, notVoidable, notFound, providerRejected, invalidResponse, defect, ...stepConfiguration } = configuration;
+  if (!connection || connection.reference.name !== connectionName) throw new TypeError("Step connection name differs from the bound connection");
+  return newMutationStep({ ...stepConfiguration, operation: connection.operations.voidEnvelope(), connection: connection.reference, branches: [
+    goToBranch("voided", voided),
+    ...notVoidable ? [goToBranch("notVoidable", notVoidable)] : [],
+    ...notFound ? [goToBranch("notFound", notFound)] : [],
+    ...providerRejected ? [goToBranch("providerRejected", providerRejected)] : [],
+    ...invalidResponse ? [goToBranch("invalidResponse", invalidResponse)] : [],
+    ...defect ? [goToBranch("defect", defect)] : []
+  ] });
+}
+function newDownloadCombinedDocumentStep(configuration) {
+  const { connection, connectionName, downloaded, notFound, tooLarge: tooLarge2, providerRejected, invalidResponse, defect, ...stepConfiguration } = configuration;
+  if (!connection || connection.reference.name !== connectionName) throw new TypeError("Step connection name differs from the bound connection");
+  return newQueryStep({ ...stepConfiguration, operation: connection.operations.downloadCombinedDocument(), connection: connection.reference, branches: [
+    goToBranch("downloaded", downloaded),
+    ...notFound ? [goToBranch("notFound", notFound)] : [],
+    ...tooLarge2 ? [goToBranch("tooLarge", tooLarge2)] : [],
+    ...providerRejected ? [goToBranch("providerRejected", providerRejected)] : [],
+    ...invalidResponse ? [goToBranch("invalidResponse", invalidResponse)] : [],
+    ...defect ? [goToBranch("defect", defect)] : []
+  ] });
+}
+
+// src/client.ts
+import { createHash as createHash2 } from "crypto";
+import { BodyTooLargeError, isHeaderSafeCredential, parseRetryAfter, readErrorTokens, sendProviderRequest } from "@superdurable/connectors-sdk/providerhttp";
+import { ManifestCredentialRefreshDriver } from "@superdurable/connectors-sdk/oauthtoken";
+import { resolveCredential, resolveCredentialAfterRejection } from "@superdurable/connectors-sdk";
+
+// src/generated/refresh.ts
+var Authorization = {
+  "defaultMethod": "docusign-oauth",
+  "methods": [
+    {
+      "fields": [
+        {
+          "name": "oauth_client_id",
+          "required": true,
+          "type": "string"
+        },
+        {
+          "name": "oauth_client_secret",
+          "required": true,
+          "type": "secretString"
+        },
+        {
+          "name": "access_token",
+          "required": true,
+          "type": "secretString"
+        },
+        {
+          "name": "refresh_token",
+          "required": true,
+          "type": "secretString"
+        },
+        {
+          "name": "connect_hmac_key",
+          "required": false,
+          "type": "secretString"
+        }
+      ],
+      "id": "docusign-oauth",
+      "oauth2": {
+        "clientIDCredential": "oauth_client_id",
+        "clientSecretCredential": "oauth_client_secret",
+        "credentialMappings": [
+          {
+            "credential": "access_token",
+            "source": "access_token"
+          },
+          {
+            "credential": "refresh_token",
+            "source": "refresh_token"
+          }
+        ],
+        "refresh": {
+          "missingExpiry": "reject",
+          "responseScopes": "ignore",
+          "storedMissingExpiry": "refresh",
+          "terminalErrorCodes": [
+            "invalid_request",
+            "invalid_client",
+            "invalid_grant",
+            "unauthorized_client"
+          ]
+        },
+        "scopes": [
+          "signature",
+          "extended"
+        ],
+        "tokenEndpoint": "https://account.docusign.com/oauth/token",
+        "tokenEndpointAuthMethod": "client_secret_basic"
+      },
+      "type": "oauth2"
+    },
+    {
+      "fields": [
+        {
+          "name": "oauth_client_id",
+          "required": true,
+          "type": "string"
+        },
+        {
+          "name": "oauth_client_secret",
+          "required": true,
+          "type": "secretString"
+        },
+        {
+          "name": "access_token",
+          "required": true,
+          "type": "secretString"
+        },
+        {
+          "name": "refresh_token",
+          "required": true,
+          "type": "secretString"
+        },
+        {
+          "name": "connect_hmac_key",
+          "required": false,
+          "type": "secretString"
+        }
+      ],
+      "id": "docusign-developer-oauth",
+      "oauth2": {
+        "clientIDCredential": "oauth_client_id",
+        "clientSecretCredential": "oauth_client_secret",
+        "credentialMappings": [
+          {
+            "credential": "access_token",
+            "source": "access_token"
+          },
+          {
+            "credential": "refresh_token",
+            "source": "refresh_token"
+          }
+        ],
+        "refresh": {
+          "missingExpiry": "reject",
+          "responseScopes": "ignore",
+          "storedMissingExpiry": "refresh",
+          "terminalErrorCodes": [
+            "invalid_request",
+            "invalid_client",
+            "invalid_grant",
+            "unauthorized_client"
+          ]
+        },
+        "scopes": [
+          "signature",
+          "extended"
+        ],
+        "tokenEndpoint": "https://account-d.docusign.com/oauth/token",
+        "tokenEndpointAuthMethod": "client_secret_basic"
+      },
+      "type": "oauth2"
+    }
+  ],
+  "refreshable": true
+};
+var CredentialFields = {
+  "access_token": "accessToken",
+  "connect_hmac_key": "connectHmacKey",
+  "oauth_client_id": "oauthClientId",
+  "oauth_client_secret": "oauthClientSecret",
+  "refresh_token": "refreshToken"
+};
+
+// src/operations.ts
+import { createHash } from "crypto";
+import { AddressRefusal } from "@superdurable/connectors-sdk/providerhttp";
+import { newMutationBranch, newMutationRetry, newMutationUncertain, newQueryBranch, newQueryRetry, zeroReceipt } from "@superdurable/connectors-sdk";
+var zeroCreated = { envelopeId: "", status: "" };
+var zeroEnvelope = { envelopeId: "", status: "" };
+var zeroRecipients = { envelopeId: "", recipients: [] };
+var zeroVoided = { envelopeId: "" };
+var zeroDocument = { envelopeId: "", contentType: "", byteCount: 0, sha256: "" };
+var malformed = "DocuSign returned a malformed response";
+var tooLarge = "DocuSign response exceeds the configured maxResponseBytes";
+var CreateEnvelopeFromTemplateOperation = class {
+  /** Bind the authenticated DocuSign client. */
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  /** Return manifest routes and Execute defaults. */
+  definition() {
+    return CreateEnvelopeFromTemplateDefinition;
+  }
+  /** Use the stable Dex Call ID as the hidden deduplication marker. */
+  idempotencyKey(callId) {
+    return callId;
+  }
+  /** Invoke one safe-to-classify create attempt. */
+  async invoke(call, input) {
+    const operation = "createEnvelopeFromTemplate";
+    const marker = call.idempotencyKey || call.id;
+    let body;
+    try {
+      body = buildCreateBody(input, marker);
+    } catch (error) {
+      return newMutationBranch("defect", zeroCreated, zeroReceipt(), failure(operation, "VALIDATION", errorMessage(error)));
+    }
+    const prior = readCreateCheckpoint(call);
+    let session;
+    try {
+      session = await this.client.openSession(call, operation);
+    } catch (error) {
+      if (!(error instanceof SessionError)) throw error;
+      if (prior) {
+        await recordCheckpoint(call, prior);
+        return error.route === "retry" ? newMutationRetry(error.failure, error.retryAfterMs) : newMutationUncertain(zeroCreated, { ...error.failure, message: `an earlier attempt sent the DocuSign create request and its outcome is unknown; ${error.failure.message}` }, this.client.receipt(""));
+      }
+      return sessionMutationFailure(error, zeroCreated, "providerRejected", "providerRejected");
+    }
+    if (prior) return recoverCreated(this.client, call, session, marker, prior, true, failure(operation, "TRANSPORT", "an earlier attempt sent the DocuSign create request and its outcome is unknown"));
+    if (call.context.attempt > 1) {
+      const found = await findBeforeResend(this.client, call, session, marker);
+      if (found) return found;
+    }
+    const checkpoint = { isDispatched: true, dispatchedAt: goTimestamp(this.client.currentTime()) };
+    try {
+      await call.context.recordHeartbeat(checkpoint);
+    } catch {
+      return newMutationRetry(failure(operation, "AVAILABILITY", "the create checkpoint could not be recorded, so nothing was sent to DocuSign"));
+    }
+    let response;
+    try {
+      response = await this.client.requestAPI(call, session, "POST", "/envelopes", void 0, body, "application/json", this.client.maxResponseBytes, 4e4);
+    } catch (error) {
+      if (isProvablyNotSent(error)) {
+        await clearCheckpoint(call);
+        return newMutationRetry(failure(operation, "TRANSPORT", "DocuSign could not be reached, so no envelope was created"));
+      }
+      return recoverCreated(this.client, call, session, marker, checkpoint, false, failure(operation, "TRANSPORT", "DocuSign's answer to the create request was lost"));
+    }
+    if (response.status === 200 || response.status === 201) {
+      try {
+        const created = decodeCreated(response.body, input.isDraft ?? false);
+        return newMutationBranch("created", created, this.client.receipt(created.envelopeId));
+      } catch {
+        return recoverCreated(this.client, call, session, marker, checkpoint, false, failure(operation, "PROTOCOL", "DocuSign accepted the create request but returned an unusable envelope summary"));
+      }
+    }
+    const outcome = this.client.classify(operation, response);
+    if (outcome.retry && response.status < 500 && response.status !== 408) {
+      await clearCheckpoint(call);
+      return newMutationRetry(outcome.failure, outcome.retryAfterMs);
+    }
+    if (response.status >= 400 && response.status < 500 && response.status !== 408) return newMutationBranch("providerRejected", zeroCreated, this.client.receipt("", outcome.errorCode), outcome.failure);
+    return recoverCreated(this.client, call, session, marker, checkpoint, false, outcome.failure);
+  }
+};
+var GetEnvelopeOperation = class {
+  /** Bind the authenticated DocuSign client. */
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  /** Return manifest routes and Execute defaults. */
+  definition() {
+    return GetEnvelopeDefinition;
+  }
+  /** Invoke one envelope read. */
+  async invoke(call, input) {
+    const operation = "getEnvelope";
+    if (!isGuid(input.envelopeId)) return newQueryBranch("defect", zeroEnvelope, zeroReceipt(), failure(operation, "VALIDATION", "envelopeId must be a DocuSign envelope ID GUID, such as 00000000-0000-0000-0000-000000000000"));
+    let session;
+    try {
+      session = await this.client.openSession(call, operation);
+    } catch (error) {
+      if (error instanceof SessionError) return sessionQueryFailure(error, zeroEnvelope);
+      throw error;
+    }
+    const read = await readEnvelope(this.client, call, session, input.envelopeId, operation);
+    if (read.error) return newQueryBranch("invalidResponse", zeroEnvelope, this.client.receipt(input.envelopeId), read.error);
+    if (read.outcome) return queryOutcome(this.client, read.outcome, input.envelopeId, zeroEnvelope);
+    if (!read.envelope) throw new Error("envelope read returned no value");
+    return newQueryBranch("found", read.envelope, this.client.receipt(read.envelope.envelopeId));
+  }
+};
+var ListEnvelopeRecipientsOperation = class {
+  /** Bind the authenticated DocuSign client. */
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  /** Return manifest routes and Execute defaults. */
+  definition() {
+    return ListEnvelopeRecipientsDefinition;
+  }
+  /** Invoke one recipients read. */
+  async invoke(call, input) {
+    const operation = "listEnvelopeRecipients";
+    if (!isGuid(input.envelopeId)) return newQueryBranch("defect", zeroRecipients, zeroReceipt(), failure(operation, "VALIDATION", "envelopeId must be a DocuSign envelope ID GUID, such as 00000000-0000-0000-0000-000000000000"));
+    let session;
+    try {
+      session = await this.client.openSession(call, operation);
+    } catch (error) {
+      if (error instanceof SessionError) return sessionQueryFailure(error, zeroRecipients);
+      throw error;
+    }
+    const envelopeId = input.envelopeId.toLowerCase();
+    let response;
+    try {
+      response = await this.client.requestAPI(call, session, "GET", `/envelopes/${escapePath(input.envelopeId)}/recipients`);
+    } catch (error) {
+      return error instanceof ResponseTooLargeError ? newQueryBranch("invalidResponse", zeroRecipients, this.client.receipt(envelopeId), failure(operation, "RESPONSE_TOO_LARGE", tooLarge)) : newQueryRetry(failure(operation, "TRANSPORT", "DocuSign could not be reached to list the recipients"));
+    }
+    if (response.status !== 200) return queryOutcome(this.client, this.client.classify(operation, response), envelopeId, zeroRecipients);
+    try {
+      return newQueryBranch("listed", decodeRecipients(response.body, envelopeId), this.client.receipt(envelopeId));
+    } catch {
+      return newQueryBranch("invalidResponse", zeroRecipients, this.client.receipt(envelopeId), failure(operation, "PROTOCOL", malformed));
+    }
+  }
+};
+var VoidEnvelopeOperation = class {
+  /** Bind the authenticated DocuSign client. */
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  /** Return manifest routes and Execute defaults. */
+  definition() {
+    return VoidEnvelopeDefinition;
+  }
+  /** Use the stable Call ID for this safely repeatable PUT. */
+  idempotencyKey(callId) {
+    return callId;
+  }
+  /** Invoke one void attempt. */
+  async invoke(call, input) {
+    const operation = "voidEnvelope";
+    if (!isGuid(input.envelopeId) || !input.voidedReason?.trim() || [...input.voidedReason].length > 200) return newMutationBranch("defect", zeroVoided, zeroReceipt(), failure(operation, "VALIDATION", !isGuid(input.envelopeId) ? "envelopeId must be a DocuSign envelope ID GUID, such as 00000000-0000-0000-0000-000000000000" : "voidedReason must be 1 to 200 characters of text"));
+    const envelopeId = input.envelopeId.toLowerCase();
+    let session;
+    try {
+      session = await this.client.openSession(call, operation);
+    } catch (error) {
+      if (error instanceof SessionError) return sessionMutationFailure(error, zeroVoided, "providerRejected", "invalidResponse");
+      throw error;
+    }
+    let response;
+    try {
+      response = await this.client.requestAPI(call, session, "PUT", `/envelopes/${escapePath(envelopeId)}`, void 0, { status: "voided", voidedReason: input.voidedReason });
+    } catch (error) {
+      if (error instanceof ResponseTooLargeError) return newMutationBranch("voided", { envelopeId }, this.client.receipt(envelopeId));
+      return newMutationRetry(failure(operation, "TRANSPORT", "DocuSign could not be reached to void the envelope; voiding again is safe"));
+    }
+    if (response.status === 200) return newMutationBranch("voided", { envelopeId }, this.client.receipt(envelopeId));
+    const outcome = this.client.classify(operation, response);
+    const receipt = this.client.receipt(envelopeId, outcome.errorCode);
+    if (outcome.retry) return newMutationRetry(outcome.failure, outcome.retryAfterMs);
+    if (outcome.notFound) return newMutationBranch("notFound", zeroVoided, receipt, outcome.failure);
+    if (!["ENVELOPE_CANNOT_VOID_INVALID_STATE", "ENVELOPE_INVALID_STATUS"].includes(outcome.errorCode.toUpperCase())) return newMutationBranch("providerRejected", zeroVoided, receipt, outcome.failure);
+    const read = await readEnvelope(this.client, call, session, envelopeId, operation);
+    if (read.error) return newMutationBranch("invalidResponse", zeroVoided, receipt, read.error);
+    if (read.outcome) return read.outcome.retry ? newMutationRetry(read.outcome.failure, read.outcome.retryAfterMs) : newMutationBranch(read.outcome.notFound ? "notFound" : "providerRejected", zeroVoided, this.client.receipt(envelopeId, read.outcome.errorCode), read.outcome.failure);
+    const envelope = read.envelope;
+    if (!envelope) throw new Error("envelope read returned no value");
+    if (envelope.status === "voided") return newMutationBranch("voided", { envelopeId, wasAlreadyVoided: true, status: envelope.status, ...envelope.voidedReason ? { voidedReason: envelope.voidedReason } : {} }, receipt);
+    if (["completed", "declined", "created"].includes(envelope.status)) return newMutationBranch("notVoidable", { envelopeId, status: envelope.status }, receipt, failure(operation, "CONFLICT", `DocuSign does not void an envelope whose status is ${envelope.status}`));
+    return newMutationBranch("providerRejected", { envelopeId: "", status: envelope.status }, receipt, outcome.failure);
+  }
+};
+var DownloadCombinedDocumentOperation = class {
+  /** Bind the authenticated DocuSign client. */
+  constructor(client) {
+    this.client = client;
+  }
+  client;
+  /** Return manifest routes and Execute defaults. */
+  definition() {
+    return DownloadCombinedDocumentDefinition;
+  }
+  /** Invoke one combined PDF read. */
+  async invoke(call, input) {
+    const operation = "downloadCombinedDocument";
+    if (!isGuid(input.envelopeId)) return newQueryBranch("defect", zeroDocument, zeroReceipt(), failure(operation, "VALIDATION", "envelopeId must be a DocuSign envelope ID GUID, such as 00000000-0000-0000-0000-000000000000"));
+    let session;
+    try {
+      session = await this.client.openSession(call, operation);
+    } catch (error) {
+      if (error instanceof SessionError) return sessionQueryFailure(error, zeroDocument);
+      throw error;
+    }
+    const envelopeId = input.envelopeId.toLowerCase();
+    let pendingHeartbeat = Promise.resolve();
+    const heartbeat = setInterval(() => {
+      pendingHeartbeat = pendingHeartbeat.then(() => call.context.recordHeartbeat(void 0)).catch(() => {
+      });
+    }, 5e3);
+    try {
+      let response;
+      try {
+        response = await this.client.openDocument(call, session, envelopeId, input.includeCertificate ?? false);
+      } catch (error) {
+        if (error instanceof ResponseTooLargeError) return newQueryBranch("tooLarge", zeroDocument, this.client.receipt(envelopeId), failure(operation, "RESPONSE_TOO_LARGE", "the combined PDF exceeds the configured maxDocumentBytes"));
+        return newQueryRetry(failure(operation, "TRANSPORT", "DocuSign could not be reached to download the combined PDF"));
+      }
+      if ("rejected" in response) return queryOutcome(this.client, this.client.classify(operation, response.rejected), envelopeId, zeroDocument);
+      try {
+        const mediaType = String(response.headers["content-type"] ?? "").split(";", 1)[0]?.trim().toLowerCase();
+        if (mediaType !== "application/pdf") return newQueryBranch("invalidResponse", zeroDocument, this.client.receipt(envelopeId), failure(operation, "PROTOCOL", "DocuSign returned something other than a PDF for the combined document"));
+        const lengthHeader = String(response.headers["content-length"] ?? "");
+        const contentLength = /^[0-9]+$/.test(lengthHeader) ? Number(lengthHeader) : 0;
+        if (Number.isSafeInteger(contentLength) && contentLength > this.client.maxDocumentBytes) return newQueryBranch("tooLarge", zeroDocument, this.client.receipt(envelopeId), failure(operation, "RESPONSE_TOO_LARGE", "the combined PDF exceeds the configured maxDocumentBytes"));
+        const digest = createHash("sha256");
+        let byteCount = 0;
+        let isComplete = false;
+        const maxBytes = this.client.maxDocumentBytes;
+        const content = (async function* () {
+          let prefix = Buffer.alloc(0);
+          try {
+            for await (const chunk of response.stream) {
+              const buffer = Buffer.from(chunk);
+              if (byteCount + buffer.length > maxBytes) throw new ResponseTooLargeError();
+              byteCount += buffer.length;
+              digest.update(buffer);
+              if (prefix.length < 5) {
+                prefix = Buffer.concat([prefix, buffer]);
+                if (prefix.length < 5) continue;
+                if (!prefix.subarray(0, 5).equals(Buffer.from("%PDF-"))) throw new InvalidPDFError();
+                yield prefix;
+              } else yield buffer;
+            }
+          } catch (error) {
+            if (error instanceof ResponseTooLargeError || error instanceof InvalidPDFError) throw error;
+            throw new DocumentUnreadError();
+          }
+          if (prefix.length < 5) throw new InvalidPDFError();
+          isComplete = true;
+        })();
+        let storedLocation = "";
+        if (this.client.documentStore) {
+          try {
+            storedLocation = await this.client.documentStore.storeCombinedDocument({ accountId: session.accountId, envelopeId, includesCertificate: input.includeCertificate ?? false }, content);
+          } catch (error) {
+            if (error instanceof ResponseTooLargeError || error instanceof InvalidPDFError || error instanceof DocumentUnreadError) throw error;
+            return newQueryBranch("invalidResponse", zeroDocument, this.client.receipt(envelopeId), failure(operation, "LOCAL_DEFECT", "the CombinedDocumentStore did not store the combined PDF"));
+          }
+          if (!isComplete) return newQueryBranch("invalidResponse", zeroDocument, this.client.receipt(envelopeId), failure(operation, "LOCAL_DEFECT", "the CombinedDocumentStore returned before reading the whole combined PDF"));
+          if (Buffer.byteLength(storedLocation) > 1024) return newQueryBranch("invalidResponse", zeroDocument, this.client.receipt(envelopeId), failure(operation, "LOCAL_DEFECT", "the CombinedDocumentStore did not store the combined PDF"));
+        } else for await (const chunk of content) {
+          void chunk;
+        }
+        const document = { envelopeId, contentType: "application/pdf", byteCount, sha256: digest.digest("hex"), ...input.includeCertificate ? { includesCertificate: true } : {}, ...storedLocation ? { storedLocation } : {} };
+        return newQueryBranch("downloaded", document, this.client.receipt(envelopeId));
+      } catch (error) {
+        if (error instanceof ResponseTooLargeError) return newQueryBranch("tooLarge", zeroDocument, this.client.receipt(envelopeId), failure(operation, "RESPONSE_TOO_LARGE", "the combined PDF exceeds the configured maxDocumentBytes"));
+        if (error instanceof InvalidPDFError) return newQueryBranch("invalidResponse", zeroDocument, this.client.receipt(envelopeId), failure(operation, "PROTOCOL", "DocuSign returned something other than a PDF for the combined document"));
+        return newQueryRetry(failure(operation, "TRANSPORT", "the combined PDF download was interrupted"));
+      } finally {
+        await response.close();
+      }
+    } finally {
+      clearInterval(heartbeat);
+      await pendingHeartbeat;
+    }
+  }
+};
+var InvalidPDFError = class extends Error {
+};
+var DocumentUnreadError = class extends Error {
+};
+function sessionQueryFailure(error, zero) {
+  if (error.route === "retry") return newQueryRetry(error.failure, error.retryAfterMs);
+  return newQueryBranch(error.route === "rejected" ? "providerRejected" : error.route, zero, zeroReceipt(), error.failure);
+}
+function sessionMutationFailure(error, zero, rejected, invalid) {
+  if (error.route === "retry") return newMutationRetry(error.failure, error.retryAfterMs);
+  return newMutationBranch(error.route === "rejected" ? rejected : error.route === "invalidResponse" ? invalid : "defect", zero, zeroReceipt(), error.failure);
+}
+function queryOutcome(client, outcome, envelopeId, zero) {
+  if (outcome.retry) return newQueryRetry(outcome.failure, outcome.retryAfterMs);
+  return newQueryBranch(outcome.notFound ? "notFound" : "providerRejected", zero, client.receipt(envelopeId, outcome.errorCode), outcome.failure);
+}
+function errorMessage(error) {
+  return error instanceof Error ? error.message : "invalid input";
+}
+function isProvablyNotSent(error) {
+  return error instanceof AddressRefusal || error instanceof Error && "isProvablyNotSent" in error && error.isProvablyNotSent === true;
+}
+async function clearCheckpoint(call) {
+  try {
+    await call.context.recordHeartbeat(void 0);
+  } catch {
+  }
+}
+async function recordCheckpoint(call, checkpoint) {
+  try {
+    await call.context.recordHeartbeat(checkpoint);
+  } catch {
+  }
+}
+function goTimestamp(value) {
+  return value.toISOString().replace(/\.([0-9]*?)0*Z$/, (_match, fraction) => fraction ? `.${fraction}Z` : "Z");
+}
+function readCreateCheckpoint(call) {
+  try {
+    if (!call.context.hasLastHeartbeatValue()) return void 0;
+    const marker = call.context.getLastHeartbeatValue();
+    if (marker === void 0 || marker === null) return void 0;
+    if (marker && typeof marker === "object" && "isDispatched" in marker && marker.isDispatched === false) return void 0;
+    if (marker && typeof marker === "object" && "isDispatched" in marker && marker.isDispatched === true && "dispatchedAt" in marker && typeof marker.dispatchedAt === "string" && !Number.isNaN(new Date(marker.dispatchedAt).getTime())) return marker;
+    return { isDispatched: true, dispatchedAt: goTimestamp(call.context.firstAttemptAt) };
+  } catch {
+    return { isDispatched: true, dispatchedAt: goTimestamp(call.context.firstAttemptAt) };
+  }
+}
+function buildCreateBody(input, marker) {
+  if (!isGuid(input.templateId)) throw new Error("templateId must be a DocuSign template ID GUID, such as 00000000-0000-0000-0000-000000000000");
+  if (!input.templateRoles || input.templateRoles.length < 1 || input.templateRoles.length > 100) throw new Error("templateRoles must fill 1 to 100 template roles");
+  if ([...input.emailSubject ?? ""].length > 100 || [...input.emailBlurb ?? ""].length > 1e4) throw new Error("emailSubject must be at most 100 characters and emailBlurb at most 10000");
+  const names = /* @__PURE__ */ new Set();
+  const roles = input.templateRoles.map((role, index) => {
+    if (!role.roleName?.trim() || [...role.roleName].length > 100) throw new Error(`templateRoles[${index}]: roleName must be 1 to 100 characters`);
+    if (!role.name?.trim() || [...role.name].length > 100) throw new Error(`templateRoles[${index}]: name must be 1 to 100 characters`);
+    const at = role.email.indexOf("@");
+    const domain = role.email.slice(at + 1);
+    if (at <= 0 || !domain.includes(".") || domain.includes("@") || Buffer.byteLength(role.email) > 100 || /[ \t\r\n<>,;]/.test(role.email)) throw new Error(`templateRoles[${index}]: email must be one email address of at most 100 characters`);
+    if ((role.routingOrder ?? 0) < 0 || (role.routingOrder ?? 0) > 999) throw new Error(`templateRoles[${index}]: routingOrder must be 1 to 999, or 0 to keep the template's order`);
+    if (names.has(role.roleName.toLowerCase())) throw new Error(`templateRoles[${index}]: role ${JSON.stringify(role.roleName)} is filled twice`);
+    names.add(role.roleName.toLowerCase());
+    return { roleName: role.roleName, name: role.name, email: role.email, ...role.routingOrder ? { routingOrder: String(role.routingOrder) } : {} };
+  });
+  if ((input.customFields?.length ?? 0) > 10) throw new Error("customFields holds at most 10 fields");
+  const fields = [{ name: "dexIdempotencyKey", value: marker, show: "false", required: "false" }];
+  const fieldNames = /* @__PURE__ */ new Set(["dexidempotencykey"]);
+  for (const [index, field] of (input.customFields ?? []).entries()) {
+    if (!field.name || [...field.name].length > 50 || [...field.value].length > 100) throw new Error(`customFields[${index}] needs a 1 to 50 character name and a value of at most 100 characters`);
+    if (fieldNames.has(field.name.toLowerCase())) throw new Error(`customFields[${index}]: name ${JSON.stringify(field.name)} is reserved or repeated`);
+    fieldNames.add(field.name.toLowerCase());
+    fields.push({ name: field.name, value: field.value, show: "false", required: "false" });
+  }
+  return { templateId: input.templateId.toLowerCase(), status: input.isDraft ? "created" : "sent", ...input.emailSubject ? { emailSubject: input.emailSubject } : {}, ...input.emailBlurb ? { emailBlurb: input.emailBlurb } : {}, templateRoles: roles, customFields: { textCustomFields: fields } };
+}
+function decodeCreated(body, isDraft) {
+  const raw = parseObject(body);
+  if (typeof raw.envelopeId !== "string" || !isGuid(raw.envelopeId) || typeof raw.status !== "string" || raw.status.toLowerCase() !== (isDraft ? "created" : "sent")) throw new Error(malformed);
+  const statusDateTime = optionalString(raw.statusDateTime);
+  return { envelopeId: raw.envelopeId.toLowerCase(), status: raw.status.toLowerCase(), ...statusDateTime ? { statusChangedAt: parseDocuSignTimestamp(statusDateTime) } : {} };
+}
+function parseObject(body) {
+  const value = JSON.parse(Buffer.from(body).toString("utf8"));
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(malformed);
+  return value;
+}
+function optionalString(value) {
+  if (value == null) return "";
+  if (typeof value !== "string") throw new Error(malformed);
+  return value;
+}
+function parseDocuSignTimestamp(value) {
+  const match = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:[.,](\d+))?(Z|[+-]\d{2}:\d{2})$/.exec(value);
+  if (!match) throw new Error(malformed);
+  const year = Number(match[1]);
+  const month = Number(match[2]);
+  const day = Number(match[3]);
+  const hour = Number(match[4]);
+  const minute = Number(match[5]);
+  const second = Number(match[6]);
+  const zone = match[8] ?? "Z";
+  if (month < 1 || month > 12 || day < 1 || day > 31 || hour > 23 || minute > 59 || second > 59 || zone !== "Z" && Number(zone.slice(4)) > 59) throw new Error(malformed);
+  const local = /* @__PURE__ */ new Date(0);
+  local.setUTCHours(0, 0, 0, 0);
+  local.setUTCFullYear(year, month - 1, day);
+  local.setUTCHours(hour, minute, second, 0);
+  if (local.getUTCFullYear() !== year || local.getUTCMonth() !== month - 1 || local.getUTCDate() !== day) throw new Error(malformed);
+  const offset = zone === "Z" ? 0 : (zone[0] === "+" ? 1 : -1) * (Number(zone.slice(1, 3)) * 60 + Number(zone.slice(4, 6)));
+  const utc = new Date(local.getTime() - offset * 6e4);
+  const seconds = utc.toISOString().slice(0, 19);
+  const fraction = (match[7] ?? "").slice(0, 9).replace(/0+$/, "");
+  return `${seconds}${fraction ? `.${fraction}` : ""}Z`;
+}
+function decodeEnvelope(body) {
+  const raw = parseObject(body);
+  const envelopeId = optionalString(raw.envelopeId);
+  const status = optionalString(raw.status).toLowerCase();
+  if (!isGuid(envelopeId) || !/^[a-z]{1,32}$/.test(status)) throw new Error(malformed);
+  const result = { envelopeId: envelopeId.toLowerCase(), status };
+  for (const [source, target] of [["emailSubject", "emailSubject"], ["voidedReason", "voidedReason"]]) {
+    const value = optionalString(raw[source]);
+    if (value) result[target] = value;
+  }
+  for (const [source, target] of [["createdDateTime", "createdAt"], ["sentDateTime", "sentAt"], ["deliveredDateTime", "deliveredAt"], ["completedDateTime", "completedAt"], ["declinedDateTime", "declinedAt"], ["voidedDateTime", "voidedAt"], ["statusChangedDateTime", "statusChangedAt"], ["expireDateTime", "expiresAt"]]) {
+    const value = optionalString(raw[source]);
+    if (value) result[target] = parseDocuSignTimestamp(value);
+  }
+  const fields = raw.customFields;
+  if (fields != null) {
+    if (typeof fields !== "object" || Array.isArray(fields)) throw new Error(malformed);
+    const text = fields.textCustomFields;
+    if (text != null && !Array.isArray(text)) throw new Error(malformed);
+    const customFields = (text ?? []).map((field) => {
+      if (!field || typeof field !== "object" || Array.isArray(field)) throw new Error(malformed);
+      const item = field;
+      return { name: optionalString(item.name), value: optionalString(item.value) };
+    }).filter((field) => field.name);
+    if (customFields.length) result.customFields = customFields;
+  }
+  return result;
+}
+async function readEnvelope(client, call, session, envelopeId, operation) {
+  let response;
+  try {
+    response = await client.requestAPI(call, session, "GET", `/envelopes/${escapePath(envelopeId)}`, { include: "custom_fields" });
+  } catch (error) {
+    return error instanceof ResponseTooLargeError ? { error: failure(operation, "RESPONSE_TOO_LARGE", tooLarge) } : { outcome: { retry: true, notFound: false, retryAfterMs: 0, errorCode: "", failure: failure(operation, "TRANSPORT", "DocuSign could not be reached to read the envelope") } };
+  }
+  if (response.status !== 200) return { outcome: client.classify(operation, response) };
+  try {
+    const envelope = decodeEnvelope(response.body);
+    if (envelope.envelopeId !== envelopeId.toLowerCase()) throw new Error(malformed);
+    return { envelope };
+  } catch {
+    return { error: failure(operation, "PROTOCOL", malformed) };
+  }
+}
+function decodeRecipients(body, envelopeId) {
+  const raw = parseObject(body);
+  const current = optionalString(raw.currentRoutingOrder);
+  const order = parseRoutingOrder(current);
+  const collections = [["signers", "signer"], ["carbonCopies", "carbonCopy"], ["certifiedDeliveries", "certifiedDelivery"], ["inPersonSigners", "inPersonSigner"], ["agents", "agent"], ["editors", "editor"], ["intermediaries", "intermediary"], ["witnesses", "witness"]];
+  const recipients = [];
+  for (const [source, type] of collections) {
+    const entries = raw[source];
+    if (entries != null && !Array.isArray(entries)) throw new Error(malformed);
+    for (const entry of entries ?? []) {
+      if (!entry || typeof entry !== "object" || Array.isArray(entry)) throw new Error(malformed);
+      const value = entry;
+      const recipientId = optionalString(value.recipientId);
+      const status = optionalString(value.status);
+      const routing = optionalString(value.routingOrder);
+      const routingOrder = parseRoutingOrder(routing);
+      if (!recipientId || !status) throw new Error(malformed);
+      const recipient = { recipientId, type, routingOrder, status: status.toLowerCase() };
+      for (const [from, to] of [["name", "name"], ["email", "email"], ["roleName", "roleName"], ["declinedReason", "declinedReason"]]) {
+        const text = optionalString(value[from]);
+        if (text) recipient[to] = text;
+      }
+      for (const [from, to] of [["sentDateTime", "sentAt"], ["deliveredDateTime", "deliveredAt"], ["signedDateTime", "signedAt"], ["declinedDateTime", "declinedAt"]]) {
+        const text = optionalString(value[from]);
+        if (text) recipient[to] = parseDocuSignTimestamp(text);
+      }
+      recipients.push(recipient);
+    }
+  }
+  recipients.sort((a, b) => a.routingOrder - b.routingOrder || compareRecipientId(a.recipientId, b.recipientId));
+  return { envelopeId, ...order ? { currentRoutingOrder: order } : {}, recipients };
+}
+function parseRoutingOrder(value) {
+  if (!value) return 0;
+  if (!/^[+-]?\d+$/.test(value)) throw new Error(malformed);
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed < 0) throw new Error(malformed);
+  return parsed;
+}
+function compareRecipientId(a, b) {
+  const number = /^[+-]?\d+$/.test(a);
+  const other = /^[+-]?\d+$/.test(b);
+  return number && other ? Number(a) - Number(b) : number ? -1 : other ? 1 : a < b ? -1 : a > b ? 1 : 0;
+}
+async function recoverCreated(client, call, session, marker, checkpoint, retryable, unknown) {
+  const uncertain = newMutationUncertain(zeroCreated, unknown, client.receipt(""));
+  const timeoutMs = recoveryRequestTimeout(call);
+  if (timeoutMs === void 0) return uncertain;
+  let response;
+  try {
+    response = await listTagged(client, call, session, marker, checkpoint.dispatchedAt, timeoutMs);
+  } catch (error) {
+    if (retryable && !(error instanceof ResponseTooLargeError)) {
+      await recordCheckpoint(call, checkpoint);
+      return newMutationRetry(failure("createEnvelopeFromTemplate", "AVAILABILITY", "DocuSign could not list envelopes to find the one an earlier attempt may have created"));
+    }
+    return uncertain;
+  }
+  if (response.status !== 200) {
+    const outcome = client.classify("createEnvelopeFromTemplate", response);
+    if (retryable && outcome.retry) {
+      await recordCheckpoint(call, checkpoint);
+      return newMutationRetry(outcome.failure, outcome.retryAfterMs);
+    }
+    return uncertain;
+  }
+  try {
+    const matches = findTagged(response.body, marker);
+    if (matches.length !== 1) return uncertain;
+    const recovered = matches[0];
+    if (!recovered) return uncertain;
+    return newMutationBranch("created", { ...recovered, wasRecovered: true }, client.receipt(recovered.envelopeId));
+  } catch {
+    return uncertain;
+  }
+}
+async function findBeforeResend(client, call, session, marker) {
+  const timeoutMs = recoveryRequestTimeout(call);
+  if (timeoutMs === void 0) return void 0;
+  let response;
+  try {
+    response = await listTagged(client, call, session, marker, call.context.firstAttemptAt.toISOString(), timeoutMs);
+  } catch (error) {
+    return error instanceof ResponseTooLargeError ? void 0 : newMutationRetry(failure("createEnvelopeFromTemplate", "AVAILABILITY", "DocuSign could not list envelopes to find the one an earlier attempt may have created"));
+  }
+  if (response.status !== 200) {
+    const outcome = client.classify("createEnvelopeFromTemplate", response);
+    return outcome.retry ? newMutationRetry(outcome.failure, outcome.retryAfterMs) : void 0;
+  }
+  try {
+    const matches = findTagged(response.body, marker);
+    if (matches.length === 1 && matches[0]) return newMutationBranch("created", { ...matches[0], wasRecovered: true }, client.receipt(matches[0].envelopeId));
+    if (matches.length > 1) return newMutationUncertain(zeroCreated, failure("createEnvelopeFromTemplate", "CONFLICT", "several DocuSign envelopes carry this Step's dexIdempotencyKey, so none was adopted and none was sent"), client.receipt(""));
+  } catch {
+  }
+  return void 0;
+}
+function listTagged(client, call, session, marker, since, timeoutMs) {
+  const from = new Date(new Date(since).getTime() - 36e5).toISOString().replace(/\.\d{3}Z$/, "Z");
+  return client.requestAPI(call, session, "GET", "/envelopes", { from_date: from, custom_field: `dexIdempotencyKey=${marker}`, include: "custom_fields" }, void 0, "application/json", client.maxResponseBytes, timeoutMs);
+}
+function recoveryRequestTimeout(call) {
+  const timeoutMs = call.context.deadline ? Math.min(25e3, call.context.deadline.getTime() - Date.now() - 2e3) : 25e3;
+  return timeoutMs >= 2e3 ? timeoutMs : void 0;
+}
+function findTagged(body, marker) {
+  const raw = parseObject(body);
+  if (raw.envelopes != null && !Array.isArray(raw.envelopes)) throw new Error(malformed);
+  return (raw.envelopes ?? []).map((entry) => decodeEnvelope(Buffer.from(JSON.stringify(entry)))).filter((envelope) => envelope.customFields?.some((field) => field.name === "dexIdempotencyKey" && field.value === marker)).map((envelope) => ({ envelopeId: envelope.envelopeId, status: envelope.status, ...envelope.statusChangedAt ? { statusChangedAt: envelope.statusChangedAt } : {} }));
+}
+
+// src/client.ts
+var guidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var productionHostPattern = /^(?!demo\.)[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.docusign\.net$/;
+var maximumErrorBodyBytes = 65536;
+var defaultResponseBytes = 1048576;
+var defaultDocumentBytes = 67108864;
+var rateLimitCodes = /* @__PURE__ */ new Set([
+  "HOURLY_APIINVOCATION_LIMIT_EXCEEDED",
+  "BURST_APIINVOCATION_LIMIT_EXCEEDED",
+  "HOURLY_ENVELOPE_POLLING_LIMIT_EXCEEDED",
+  "BURST_ENVELOPE_POLLING_LIMIT_EXCEEDED",
+  "HOURLY_APIINVOCATION_ENVELOPE_LIMIT_EXCEEDED",
+  "BURST_APIINVOCATION_ENVELOPE_LIMIT_EXCEEDED"
+]);
+var SessionError = class extends Error {
+  /** Keep the route and sanitized failure for an operation. */
+  constructor(route, failure2, retryAfterMs = 0) {
+    super(failure2.message);
+    this.route = route;
+    this.failure = failure2;
+    this.retryAfterMs = retryAfterMs;
+  }
+  route;
+  failure;
+  retryAfterMs;
+};
+var ResponseTooLargeError = class extends Error {
+};
+function isGuid(value) {
+  return guidPattern.test(value);
+}
+function escapePath(value) {
+  return Array.from(Buffer.from(value)).map((byte) => {
+    const character = String.fromCharCode(byte);
+    return /^[A-Za-z0-9\-._~$&+=:@]$/.test(character) ? character : `%${byte.toString(16).toUpperCase().padStart(2, "0")}`;
+  }).join("");
+}
+function failure(operation, kind, message) {
+  return { kind, provider: "docusign", operation, message };
+}
+var DocuSignClient2 = class {
+  /** Validate connection settings and bind host-owned renewable credentials. */
+  constructor(config, credentials, options = {}) {
+    this.credentials = credentials;
+    if (!credentials) throw new TypeError("DocuSign credential provider is required");
+    this.accountId = config.accountId ?? "";
+    if (this.accountId && !isGuid(this.accountId)) throw new TypeError("configuration accountId must be a DocuSign API account ID GUID, such as 00000000-0000-0000-0000-000000000000");
+    this.maxResponseBytes = config.maxResponseBytes || defaultResponseBytes;
+    this.maxDocumentBytes = config.maxDocumentBytes || defaultDocumentBytes;
+    if (!Number.isSafeInteger(this.maxResponseBytes) || this.maxResponseBytes <= 0) throw new TypeError("maxResponseBytes must be positive");
+    if (!Number.isSafeInteger(this.maxDocumentBytes) || this.maxDocumentBytes <= 0) throw new TypeError("maxDocumentBytes must be positive");
+    if (config.connectMaxBodyBytes !== void 0 && (!Number.isSafeInteger(config.connectMaxBodyBytes) || config.connectMaxBodyBytes < 0)) throw new TypeError("connectMaxBodyBytes must be non-negative");
+    this.send = options.send ?? sendProviderRequest;
+    this.hasCustomSend = options.send !== void 0;
+    this.now = options.now ?? (() => /* @__PURE__ */ new Date());
+    this.documentStore = options.documentStore;
+  }
+  credentials;
+  maxResponseBytes;
+  maxDocumentBytes;
+  documentStore;
+  accountId;
+  send;
+  hasCustomSend;
+  now;
+  accountCache = /* @__PURE__ */ new Map();
+  refreshDriver = new ManifestCredentialRefreshDriver({ providerName: "DocuSign", auth: Authorization, credentialFields: CredentialFields });
+  /** Bind the template creation Mutation. */
+  createEnvelopeFromTemplate() {
+    return new CreateEnvelopeFromTemplateOperation(this);
+  }
+  /** Bind the envelope Query. */
+  getEnvelope() {
+    return new GetEnvelopeOperation(this);
+  }
+  /** Bind the recipients Query. */
+  listEnvelopeRecipients() {
+    return new ListEnvelopeRecipientsOperation(this);
+  }
+  /** Bind the void Mutation. */
+  voidEnvelope() {
+    return new VoidEnvelopeOperation(this);
+  }
+  /** Bind the combined PDF Query. */
+  downloadCombinedDocument() {
+    return new DownloadCombinedDocumentOperation(this);
+  }
+  /** Resolve renewable credentials and DocuSign's own account host. */
+  async openSession(call, operation) {
+    let credentials;
+    try {
+      credentials = await resolveCredential(this.credentials, call, this.refreshDriver, call.context.cancellationSignal);
+    } catch (error) {
+      const isTerminal = error instanceof Error && error.name === "ReauthorizationRequiredError";
+      throw new SessionError(isTerminal ? "defect" : "retry", failure(operation, isTerminal ? "AUTHENTICATION" : "AVAILABILITY", isTerminal ? "the DocuSign connection needs reauthorization; authorize it again in Dex Web Connections" : "the DocuSign access token could not be loaded or refreshed yet"));
+    }
+    if (!isHeaderSafeCredential(credentials.accessToken.reveal())) throw new SessionError("defect", failure(operation, "AUTHENTICATION", "the DocuSign access token is blank or contains characters a header cannot carry"));
+    const method = credentials.authMethodId ?? "docusign-oauth";
+    if (method !== "docusign-oauth" && method !== "docusign-developer-oauth") throw new SessionError("defect", failure(operation, "LOCAL_DEFECT", "the DocuSign connection names no known environment; authorize it again in Dex Web Connections"));
+    const key = `${call.connection.provider}/${call.connection.name}/${createHash2("sha256").update(credentials.accessToken.reveal()).digest("hex")}`;
+    const cached = this.accountCache.get(key);
+    if (cached && this.now().getTime() - cached.at < 36e5) return { credentials, accountId: cached.accountId, baseUri: cached.baseUri };
+    const accountServer = method === "docusign-developer-oauth" ? "https://account-d.docusign.com" : "https://account.docusign.com";
+    let response;
+    try {
+      response = await this.request(call, credentials, "GET", `${accountServer}/oauth/userinfo`, void 0, "application/json", this.maxResponseBytes);
+    } catch (error) {
+      if (error instanceof ResponseTooLargeError) throw new SessionError("invalidResponse", failure(operation, "RESPONSE_TOO_LARGE", "DocuSign account information exceeds the configured maxResponseBytes"));
+      throw new SessionError("retry", failure(operation, "TRANSPORT", "DocuSign account information could not be read"));
+    }
+    if (response.status === 429) throw new SessionError("retry", failure(operation, "RATE_LIMIT", "DocuSign limited the hourly account information requests for this user or integration key"), nextHour(this.now()));
+    if (response.status >= 500 || response.status === 408) throw new SessionError("retry", failure(operation, "AVAILABILITY", `DocuSign account information answered HTTP ${response.status}`));
+    if (response.status === 401) throw new SessionError("rejected", failure(operation, "AUTHENTICATION", "DocuSign rejected the access token; authorize the connection again"));
+    if (response.status !== 200) throw new SessionError("rejected", failure(operation, "PROVIDER_REJECTION", `DocuSign account information answered HTTP ${response.status}`));
+    let accounts;
+    try {
+      accounts = JSON.parse(Buffer.from(response.body).toString("utf8")).accounts;
+    } catch {
+      throw new SessionError("invalidResponse", failure(operation, "PROTOCOL", "DocuSign returned a malformed response: account information lists no accounts"));
+    }
+    if (!Array.isArray(accounts) || accounts.length === 0) throw new SessionError("invalidResponse", failure(operation, "PROTOCOL", "DocuSign returned a malformed response: account information lists no accounts"));
+    for (const entry of accounts) {
+      if (entry === null) continue;
+      if (typeof entry !== "object" || Array.isArray(entry)) throw new SessionError("invalidResponse", failure(operation, "PROTOCOL", "DocuSign returned a malformed response: account information lists no accounts"));
+      const account = entry;
+      if ([account.account_id, account.base_uri].some((value) => value !== void 0 && value !== null && typeof value !== "string")) {
+        throw new SessionError("invalidResponse", failure(operation, "PROTOCOL", "DocuSign returned a malformed response: account information lists no accounts"));
+      }
+    }
+    const selected = accounts.find((entry) => {
+      if (!entry || typeof entry !== "object" || Array.isArray(entry)) return false;
+      const account = entry;
+      return this.accountId ? typeof account.account_id === "string" && account.account_id.toLowerCase() === this.accountId.toLowerCase() : account.is_default === true || account.is_default === "true";
+    });
+    if (!selected) throw new SessionError("defect", failure(operation, "VALIDATION", this.accountId ? "the authorizing DocuSign user does not belong to the configured accountId; correct accountId or authorize as a member of that account" : "DocuSign reports no default account for the authorizing user; set the connection's accountId"));
+    if (typeof selected.account_id !== "string" || !isGuid(selected.account_id) || typeof selected.base_uri !== "string") throw new SessionError("invalidResponse", failure(operation, "PROTOCOL", "DocuSign returned a malformed response: the account ID is not a GUID"));
+    const baseUriMatch = /^https:\/\/([a-z0-9.-]+)\/?$/.exec(selected.base_uri);
+    const host = baseUriMatch?.[1];
+    if (!host || !(method === "docusign-developer-oauth" ? host === "demo.docusign.net" : productionHostPattern.test(host))) {
+      throw new SessionError("invalidResponse", failure(operation, "PROTOCOL", "DocuSign returned a malformed response: the account base URI is not a DocuSign eSignature host of this environment"));
+    }
+    const baseUri = `https://${host}`;
+    const accountId = selected.account_id.toLowerCase();
+    this.accountCache.set(key, { accountId, baseUri, at: this.now().getTime() });
+    return { credentials, accountId, baseUri };
+  }
+  /** Send one eSignature request after account selection. */
+  requestAPI(call, session, method, path, query, body, accept = "application/json", limit = this.maxResponseBytes, timeoutMs = 25e3) {
+    const suffix = query ? `?${Object.entries(query).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, value]) => `${goQueryEscape(key)}=${goQueryEscape(value)}`).join("&")}` : "";
+    return this.request(call, session.credentials, method, `${session.baseUri}/restapi/v2.1/accounts/${escapePath(session.accountId)}${path}${suffix}`, body, accept, limit, timeoutMs);
+  }
+  /** Open the combined PDF without buffering a successful response in Dex memory. */
+  async openDocument(call, session, envelopeId, includeCertificate) {
+    const path = `/restapi/v2.1/accounts/${escapePath(session.accountId)}/envelopes/${escapePath(envelopeId)}/documents/combined?certificate=${includeCertificate}`;
+    if (this.hasCustomSend) {
+      const response = await this.requestAPI(call, session, "GET", `/envelopes/${escapePath(envelopeId)}/documents/combined`, { certificate: String(includeCertificate) }, void 0, "application/pdf", this.maxDocumentBytes, 11e4);
+      if (response.status < 200 || response.status >= 300) return { rejected: response };
+      return { headers: response.headers, stream: (async function* () {
+        yield response.body;
+      })(), async close() {
+      } };
+    }
+    let credentials = session.credentials;
+    for (let attempt = 0; attempt < 2; attempt++) {
+      const controller = new AbortController();
+      const timeout = setTimeout(() => controller.abort(), 11e4);
+      const onCancel = () => controller.abort(call.context.cancellationSignal.reason);
+      call.context.cancellationSignal.addEventListener("abort", onCancel, { once: true });
+      let response;
+      try {
+        response = await fetch(`${session.baseUri}${path}`, {
+          method: "GET",
+          headers: { Authorization: `Bearer ${credentials.accessToken.reveal()}`, Accept: "application/pdf" },
+          redirect: "manual",
+          signal: controller.signal
+        });
+      } catch (error) {
+        clearTimeout(timeout);
+        call.context.cancellationSignal.removeEventListener("abort", onCancel);
+        throw error;
+      }
+      const headers = {};
+      response.headers.forEach((value, name) => {
+        headers[name] = value;
+      });
+      const rejectedBody = response.status < 200 || response.status >= 300 ? await readErrorBody(response, maximumErrorBodyBytes) : void 0;
+      if (response.status === 401 && attempt === 0 && "resolveAfterRejection" in this.credentials) {
+        clearTimeout(timeout);
+        call.context.cancellationSignal.removeEventListener("abort", onCancel);
+        try {
+          credentials = await resolveCredentialAfterRejection(this.credentials, call, this.refreshDriver, call.context.cancellationSignal);
+        } catch {
+          return { rejected: { status: 401, headers, body: rejectedBody ?? new Uint8Array(), isTooLarge: false } };
+        }
+        if (!isHeaderSafeCredential(credentials.accessToken.reveal())) return { rejected: { status: 401, headers, body: rejectedBody ?? new Uint8Array(), isTooLarge: false } };
+        continue;
+      }
+      if (response.status < 200 || response.status >= 300) {
+        clearTimeout(timeout);
+        call.context.cancellationSignal.removeEventListener("abort", onCancel);
+        return { rejected: { status: response.status, headers, body: rejectedBody ?? new Uint8Array(), isTooLarge: false } };
+      }
+      const reader = response.body?.getReader();
+      if (!reader) {
+        clearTimeout(timeout);
+        call.context.cancellationSignal.removeEventListener("abort", onCancel);
+        throw new Error("DocuSign PDF body was unreadable");
+      }
+      const stream = (async function* () {
+        while (true) {
+          const chunk = await reader.read();
+          if (chunk.done) return;
+          yield chunk.value;
+        }
+      })();
+      return { headers, stream, async close() {
+        await reader.cancel().catch(() => {
+        });
+        clearTimeout(timeout);
+        call.context.cancellationSignal.removeEventListener("abort", onCancel);
+      } };
+    }
+    throw new Error("DocuSign PDF authentication retry exhausted");
+  }
+  /** Classify one conclusive refusal without exposing provider messages. */
+  classify(operation, response) {
+    const errorCode = readErrorTokens(response.body, ["/errorCode", "/error"])[0] ?? "";
+    const code = errorCode.toUpperCase();
+    const status = response.status;
+    let retry = false;
+    let notFound = false;
+    let retryAfterMs = 0;
+    let kind;
+    let message;
+    if (rateLimitCodes.has(code) || status === 429) {
+      retry = true;
+      kind = "RATE_LIMIT";
+      message = "DocuSign rate limited the request";
+      const resetHeader = String(response.headers["x-ratelimit-reset"] ?? "");
+      const reset = /^[0-9]+$/.test(resetHeader) ? Number(resetHeader) : 0;
+      const resetDelay = Number.isSafeInteger(reset) && reset > 0 ? Math.max(0, reset * 1e3 - this.now().getTime()) : 0;
+      retryAfterMs = code.startsWith("BURST_") ? 3e4 : Math.min(resetDelay || parseRetryAfter(String(response.headers["retry-after"] ?? ""), this.now()) || (code.startsWith("HOURLY_") ? nextHour(this.now()) : 0), 36e5);
+    } else if (status >= 500 || status === 408) {
+      retry = true;
+      kind = "AVAILABILITY";
+      message = `DocuSign answered HTTP ${status}`;
+    } else if (code === "ENVELOPE_ALLOWANCE_EXCEEDED") {
+      kind = "QUOTA_EXHAUSTED";
+      message = "the DocuSign account has no envelope allowance left";
+    } else if (status === 401 || ["USER_AUTHENTICATION_FAILED", "AUTHORIZATION_INVALID_TOKEN", "PARTNER_AUTHENTICATION_FAILED"].includes(code)) {
+      kind = "AUTHENTICATION";
+      message = "DocuSign rejected the access token; authorize the connection again";
+    } else if (status === 403 || ["ACCOUNT_LACKS_PERMISSIONS", "USER_LACKS_PERMISSIONS", "USER_DOES_NOT_BELONG_TO_SPECIFIED_ACCOUNT", "ACCOUNT_NOT_AUTHORIZED_FOR_ENVELOPE", "USER_NOT_ENVELOPE_SENDER_OR_RECIPIENT", "USER_LACKS_MEMBERSHIP", "USER_NOT_ACCOUNT_ADMIN"].includes(code)) {
+      kind = "AUTHORIZATION";
+      message = "DocuSign denied permission for this account, user, or envelope";
+    } else if (status === 404 || ["ENVELOPE_DOES_NOT_EXIST", "RESOURCE_NOT_FOUND", "DOCUMENT_DOES_NOT_EXIST"].includes(code)) {
+      notFound = true;
+      kind = "NOT_FOUND";
+      message = "the DocuSign envelope or document was not found";
+    } else {
+      kind = "PROVIDER_REJECTION";
+      message = `DocuSign rejected the request with HTTP ${status}`;
+    }
+    return { retry, notFound, retryAfterMs, errorCode, failure: failure(operation, kind, errorCode ? `${message} (${errorCode})` : message) };
+  }
+  /** Build a provider receipt with only safe envelope identity and error code. */
+  receipt(envelopeId, errorCode = "") {
+    return { provider: "docusign", providerObjectId: envelopeId, observedAt: this.now().toISOString(), ...errorCode ? { metadata: { errorCode } } : {} };
+  }
+  /** Return the injected clock for recovery windows and receipts. */
+  currentTime() {
+    return this.now();
+  }
+  async request(call, credentials, method, url, body, accept, limit, timeoutMs = 25e3) {
+    const encoded = body === void 0 ? void 0 : Buffer.from(JSON.stringify(body));
+    let current = credentials;
+    for (let attempt = 0; attempt < 2; attempt++) {
+      const request = {
+        url,
+        method,
+        headers: { Authorization: `Bearer ${current.accessToken.reveal()}`, Accept: accept, ...encoded ? { "Content-Type": "application/json" } : {} },
+        ...encoded ? { body: encoded } : {},
+        maxResponseBytes: Math.max(limit, maximumErrorBodyBytes),
+        addressPolicy: "publicHTTPS",
+        timeoutMs,
+        signal: call.context.cancellationSignal
+      };
+      let response;
+      try {
+        response = await this.send(request);
+      } catch (error) {
+        if (error instanceof BodyTooLargeError && error.status !== void 0 && error.headers !== void 0 && (error.status < 200 || error.status >= 300)) return { status: error.status, headers: error.headers, body: new Uint8Array(), isTooLarge: false };
+        if (error instanceof BodyTooLargeError) throw new ResponseTooLargeError();
+        throw error;
+      }
+      const answer = { ...response, isTooLarge: response.status >= 200 && response.status < 300 && response.body.length > limit };
+      if (answer.isTooLarge) throw new ResponseTooLargeError();
+      if (response.status !== 401 || attempt !== 0 || !("resolveAfterRejection" in this.credentials)) return answer;
+      try {
+        current = await resolveCredentialAfterRejection(this.credentials, call, this.refreshDriver, call.context.cancellationSignal);
+      } catch {
+        return answer;
+      }
+      if (!isHeaderSafeCredential(current.accessToken.reveal())) return answer;
+    }
+    throw new Error("DocuSign authenticated request retry was exhausted");
+  }
+};
+function nextHour(now) {
+  return 36e5 - now.getTime() % 36e5;
+}
+function goQueryEscape(value) {
+  return encodeURIComponent(value).replace(/%20/g, "+").replace(/[!'()*]/g, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+async function readErrorBody(response, maximumBytes) {
+  const reader = response.body?.getReader();
+  if (!reader) return new Uint8Array();
+  const chunks = [];
+  let length = 0;
+  try {
+    while (length < maximumBytes) {
+      const chunk = await reader.read();
+      if (chunk.done) break;
+      const bounded = chunk.value.subarray(0, maximumBytes - length);
+      chunks.push(bounded);
+      length += bounded.length;
+    }
+  } catch {
+  } finally {
+    await reader.cancel().catch(() => {
+    });
+  }
+  return Buffer.concat(chunks, length);
+}
+
+// src/project.ts
+function encodeCredentials(credentials) {
+  return {
+    auth_method: credentials.authMethodId ?? "docusign-oauth",
+    oauth_client_id: credentials.oauthClientId,
+    oauth_client_secret: credentials.oauthClientSecret?.reveal() ?? "",
+    access_token: credentials.accessToken.reveal(),
+    refresh_token: credentials.refreshToken?.reveal() ?? "",
+    connect_hmac_key: credentials.connectHmacKey?.reveal() ?? ""
+  };
+}
+function newProjectConnection2(project, connectionName, options = {}) {
+  return newProjectConnection(project, connectionName, (loadedProject, name) => {
+    const selected = loadedProject.configuration.connections.find((entry) => entry.connectorId === "docusign" && entry.connectionName === name);
+    if (!selected) throw new TypeError("DocuSign project connection is not configured");
+    const parsed = ConfigSchema.parse(selected.configuration);
+    const config = {
+      ...parsed.accountId !== void 0 ? { accountId: parsed.accountId } : {},
+      ...parsed.maxResponseBytes !== void 0 ? { maxResponseBytes: parsed.maxResponseBytes } : {},
+      ...parsed.maxDocumentBytes !== void 0 ? { maxDocumentBytes: parsed.maxDocumentBytes } : {},
+      ...parsed.connectMaxBodyBytes !== void 0 ? { connectMaxBodyBytes: parsed.connectMaxBodyBytes } : {}
+    };
+    return new DocuSignClient2(config, newProjectCredentialProvider(loadedProject, name, decodeCredentials, encodeCredentials, decodeSharedCredentials), options);
+  });
+}
+export {
+  CombinedDocumentSchema,
+  ConfigSchema,
+  Connection,
+  ConnectorID,
+  CreateEnvelopeFromTemplateBranch,
+  CreateEnvelopeFromTemplateBranchCreated,
+  CreateEnvelopeFromTemplateBranchDefect,
+  CreateEnvelopeFromTemplateBranchProviderRejected,
+  CreateEnvelopeFromTemplateBranchUncertain,
+  CreateEnvelopeFromTemplateDefinition,
+  CreateEnvelopeFromTemplateInputSchema,
+  CreateEnvelopeFromTemplateMetadata,
+  CreateEnvelopeFromTemplateOperation,
+  CreatedEnvelopeSchema,
+  DocuSignClient2 as DocuSignClient,
+  DownloadCombinedDocumentBranch,
+  DownloadCombinedDocumentBranchDefect,
+  DownloadCombinedDocumentBranchDownloaded,
+  DownloadCombinedDocumentBranchInvalidResponse,
+  DownloadCombinedDocumentBranchNotFound,
+  DownloadCombinedDocumentBranchProviderRejected,
+  DownloadCombinedDocumentBranchTooLarge,
+  DownloadCombinedDocumentDefinition,
+  DownloadCombinedDocumentInputSchema,
+  DownloadCombinedDocumentMetadata,
+  DownloadCombinedDocumentOperation,
+  EnvelopeCustomFieldSchema,
+  EnvelopeRecipientsSchema,
+  EnvelopeSchema,
+  GetEnvelopeBranch,
+  GetEnvelopeBranchDefect,
+  GetEnvelopeBranchFound,
+  GetEnvelopeBranchInvalidResponse,
+  GetEnvelopeBranchNotFound,
+  GetEnvelopeBranchProviderRejected,
+  GetEnvelopeDefinition,
+  GetEnvelopeInputSchema,
+  GetEnvelopeMetadata,
+  GetEnvelopeOperation,
+  ListEnvelopeRecipientsBranch,
+  ListEnvelopeRecipientsBranchDefect,
+  ListEnvelopeRecipientsBranchInvalidResponse,
+  ListEnvelopeRecipientsBranchListed,
+  ListEnvelopeRecipientsBranchNotFound,
+  ListEnvelopeRecipientsBranchProviderRejected,
+  ListEnvelopeRecipientsDefinition,
+  ListEnvelopeRecipientsInputSchema,
+  ListEnvelopeRecipientsMetadata,
+  ListEnvelopeRecipientsOperation,
+  ProviderID,
+  RecipientSchema,
+  TemplateRoleSchema,
+  VoidEnvelopeBranch,
+  VoidEnvelopeBranchDefect,
+  VoidEnvelopeBranchInvalidResponse,
+  VoidEnvelopeBranchNotFound,
+  VoidEnvelopeBranchNotVoidable,
+  VoidEnvelopeBranchProviderRejected,
+  VoidEnvelopeBranchVoided,
+  VoidEnvelopeDefinition,
+  VoidEnvelopeInputSchema,
+  VoidEnvelopeMetadata,
+  VoidEnvelopeOperation,
+  VoidedEnvelopeSchema,
+  decodeCredentials,
+  decodeSharedCredentials,
+  newConnection,
+  newConnectionWithOperations,
+  newCreateEnvelopeFromTemplateStep,
+  newDownloadCombinedDocumentStep,
+  newGetEnvelopeStep,
+  newListEnvelopeRecipientsStep,
+  newProjectConnection2 as newProjectConnection,
+  newVoidEnvelopeStep
+};