@tokensmind/agent-network 0.1.0

package/skills/tokensmind-agent-network-runtime/scripts/lib/workflow-store.js

@@ -0,0 +1,77 @@
+import { promises as defaultFs } from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import os from 'node:os';
+import path from 'node:path';
+import { originNamespace, resolvePortableStateDir } from './runtime/portableStore.js';
+
+const DIRECTORY_MODE = 0o700;
+const FILE_MODE = 0o600;
+
+function recordPath({ stateDir, origin, platform, homeDir }) {
+  const base = stateDir || resolvePortableStateDir({ platform, homeDir });
+  return path.join(path.resolve(base), originNamespace(origin), 'workflow.json');
+}
+
+async function ensureDirectory(fs, filePath, platform) {
+  const directory = path.dirname(filePath);
+  await fs.mkdir(directory, { recursive: true, mode: DIRECTORY_MODE });
+  if (platform !== 'win32') await fs.chmod(directory, DIRECTORY_MODE);
+}
+
+async function writeCandidate({ fs, filePath, platform, value }) {
+  const temporary = path.join(path.dirname(filePath), `.${process.pid}.${randomUUID()}.tmp`);
+  try {
+    await fs.writeFile(temporary, JSON.stringify(value), {
+      encoding: 'utf8', mode: FILE_MODE, flag: 'wx',
+    });
+    if (platform !== 'win32') await fs.chmod(temporary, FILE_MODE);
+    try {
+      await fs.link(temporary, filePath);
+    } catch (error) {
+      if (error?.code !== 'EEXIST') throw error;
+    }
+  } finally {
+    try {
+      await fs.unlink(temporary);
+    } catch (error) {
+      if (error?.code !== 'ENOENT') throw error;
+    }
+  }
+}
+
+export function createWorkflowStore({
+  stateDir,
+  origin,
+  platform = process.platform,
+  homeDir = os.homedir(),
+  fs = defaultFs,
+} = {}) {
+  const filePath = recordPath({ stateDir, origin, platform, homeDir });
+  return {
+    async read(name = 'workflow') {
+      if (name !== 'workflow') throw new Error(`Unsupported workflow record: ${name}`);
+      try {
+        return JSON.parse(await fs.readFile(filePath, 'utf8'));
+      } catch (error) {
+        if (error?.code === 'ENOENT') return null;
+        if (error instanceof SyntaxError) throw new Error('Workflow state is invalid JSON', { cause: error });
+        throw error;
+      }
+    },
+    async write(name, value) {
+      if (name !== 'workflow') throw new Error(`Unsupported workflow record: ${name}`);
+      await ensureDirectory(fs, filePath, platform);
+      await writeCandidate({ fs, filePath, platform, value });
+    },
+    async remove(name = 'workflow') {
+      if (name !== 'workflow') throw new Error(`Unsupported workflow record: ${name}`);
+      try {
+        await fs.unlink(filePath);
+        return true;
+      } catch (error) {
+        if (error?.code === 'ENOENT') return false;
+        throw error;
+      }
+    },
+  };
+}

package/skills/tokensmind-agent-network-runtime/scripts/python_runtime/__init__.py

@@ -0,0 +1 @@
+"""TokensMind Agent Network portable Python runtime."""

package/skills/tokensmind-agent-network-runtime/scripts/python_runtime/browser.py

@@ -0,0 +1,27 @@
+import webbrowser
+
+
+class BrowserOpener:
+    def __init__(self, open_impl=webbrowser.open):
+        self._open_impl = open_impl
+
+    def open(self, url):
+        if not self._open_impl(url, new=2):
+            raise RuntimeError("Unable to open the TokensMind authorization page")
+
+
+class ReportingBrowser:
+    def __init__(self, browser, write_event):
+        self._browser = browser
+        self._write_event = write_event
+
+    def open(self, url):
+        try:
+            self._browser.open(url)
+            self._write_event({"event": "authorization_opened", "verificationUrl": url})
+        except Exception:
+            self._write_event({
+                "event": "authorization_required",
+                "verificationUrl": url,
+                "message": "Open this URL to approve the pending Agent Network connection.",
+            })

package/skills/tokensmind-agent-network-runtime/scripts/python_runtime/connector.py

@@ -0,0 +1,156 @@
+import json
+import threading
+import uuid
+
+from .device_authorization import (
+    create_pending_authorization,
+    create_remote_authorization,
+    exchange_authorization,
+    wait_for_approval,
+)
+from .errors import AgentNetworkHttpError
+from .http_client import UNSET
+from .request_policy import (
+    build_business_url,
+    is_public_discovery_request,
+    validate_business_request,
+)
+from action_support import AuthorizationRequired
+
+INVALID_CREDENTIAL_CODES = frozenset((
+    "AGENT_CREDENTIAL_EXPIRED",
+    "AGENT_CREDENTIAL_INVALID",
+    "AGENT_CREDENTIAL_REVOKED",
+))
+TERMINAL_AUTHORIZATION_CODES = frozenset((
+    "DEVICE_AUTHORIZATION_DENIED",
+    "DEVICE_AUTHORIZATION_EXCHANGED",
+    "DEVICE_AUTHORIZATION_EXPIRED",
+))
+
+
+def _operations_match(left, right):
+    options = {"sort_keys": True, "separators": (",", ":"), "ensure_ascii": False}
+    return json.dumps(left, **options) == json.dumps(right, **options)
+
+
+def _is_http_error(error, codes):
+    return isinstance(error, AgentNetworkHttpError) and error.code in codes
+
+
+class AgentNetworkConnector:
+    def __init__(self, store, browser, base_url, *, http, client):
+        self._store = store
+        self._browser = browser
+        self._base_url = base_url
+        self._http = http
+        self._client = client
+        self._lock = threading.Lock()
+
+    def execute(self, params):
+        with self._lock:
+            return self._execute_once(params)
+
+    def _execute_once(self, params):
+        operation = validate_business_request(params)
+        if "body" in params:
+            operation["body"] = params["body"]
+        reauthorize = params.get("reauthorize") is True
+        pending = self._store.read("pending")
+        active = self._store.read("active")
+        if pending:
+            return self._resume_pending(pending, active, operation)
+        if is_public_discovery_request(operation) and not reauthorize:
+            return self._execute_business_request(operation)
+        if not active or reauthorize:
+            active = self._authorize(operation)
+            return self._execute_and_finalize(self._store.read("pending"), active)
+        try:
+            return self._execute_business_request(operation, active["token"])
+        except AgentNetworkHttpError as error:
+            if error.code not in INVALID_CREDENTIAL_CODES:
+                raise
+            self._store.remove("active")
+            active = self._authorize(operation)
+            return self._execute_and_finalize(self._store.read("pending"), active)
+
+    def _resume_pending(self, pending, active, operation):
+        if not _operations_match(pending["operation"], operation):
+            raise ValueError(
+                "A different Agent Network operation is pending; retry the original operation first",
+            )
+        active = self._authorize(pending["operation"])
+        return self._execute_and_finalize(self._store.read("pending"), active)
+
+    def _prepare_pending(self, operation):
+        existing = self._store.read("pending")
+        if existing:
+            return existing
+        instance = self._store.read("instance")
+        if not instance:
+            instance = {"id": str(uuid.uuid4())}
+            self._store.write("instance", instance)
+        pending = create_pending_authorization(operation, instance["id"])
+        self._store.write("pending", pending)
+        return pending
+
+    def _authorize(self, operation):
+        try:
+            pending = self._prepare_pending(operation)
+            if pending["phase"] == "prepared":
+                pending = create_remote_authorization(
+                    pending, self._base_url, self._http, client=self._client,
+                )
+                self._store.write("pending", pending)
+                self._browser.open(pending["authorization"]["verificationUrl"])
+                raise AuthorizationRequired(pending["authorization"]["verificationUrl"])
+            if pending["phase"] == "authorizing":
+                return self._complete_authorization(pending)
+            return self._store.read("active")
+        except AgentNetworkHttpError as error:
+            if error.code in TERMINAL_AUTHORIZATION_CODES:
+                self._store.remove("pending")
+            raise
+
+    def _complete_authorization(self, pending):
+        wait_for_approval(pending, self._base_url, self._http)
+        exchange = exchange_authorization(pending, self._base_url, self._http)
+        active = {
+            "token": pending["token"],
+            "agentId": (exchange.get("agent") or {}).get("id"),
+            "credentialId": exchange["credential"]["id"],
+            "tokenPrefix": exchange["credential"]["tokenPrefix"],
+        }
+        self._store.write("active", active)
+        updated = dict(pending)
+        updated["phase"] = "authorized"
+        self._store.write("pending", updated)
+        return active
+
+    def _execute_business_request(self, operation, token=None):
+        headers = {"Content-Type": "application/json"}
+        if token:
+            headers["Authorization"] = "Bearer %s" % token
+        if operation.get("idempotencyKey"):
+            headers["Idempotency-Key"] = operation["idempotencyKey"]
+        body = operation["body"] if "body" in operation else UNSET
+        return self._http.request(
+            build_business_url(self._base_url, operation["path"]),
+            method=operation["method"],
+            headers=headers,
+            body=body,
+        )
+
+    def _execute_and_finalize(self, pending, active):
+        if not active or not active.get("token"):
+            raise ValueError("Authorized Agent Network operation has no active stored credential")
+        try:
+            result = self._execute_business_request(pending["operation"], active["token"])
+            self._store.remove("pending")
+            return result
+        except AgentNetworkHttpError as error:
+            if error.status < 500 and error.status != 429:
+                self._store.remove("pending")
+                if error.code in INVALID_CREDENTIAL_CODES:
+                    self._store.remove("active")
+            raise

package/skills/tokensmind-agent-network-runtime/scripts/python_runtime/constants.py

@@ -0,0 +1,12 @@
+import re
+
+DEFAULT_BASE_URL = "https://tokensmind.ai"
+DEVICE_AUTHORIZATION_PATH = "/agent-network-api/device-authorizations"
+DEVICE_CODE_PREFIX = "tm_device_"
+AGENT_TOKEN_PREFIX = "tm_agent_"
+SUPPORTED_METHODS = frozenset(("GET", "POST", "PATCH", "DELETE"))
+MUTATION_METHODS = frozenset(("POST", "PATCH", "DELETE"))
+INTERNAL_PATH_PATTERNS = (
+    re.compile(r"^/agent-network-api/device-authorizations(?:/|$)"),
+    re.compile(r"^/agent-network-api/agents/[^/]+/credentials(?:/|$)"),
+)

package/skills/tokensmind-agent-network-runtime/scripts/python_runtime/credential_store.py

@@ -0,0 +1,135 @@
+import os
+from pathlib import Path
+
+from .portable_store import (
+    PortableStore,
+    RECORD_NAMES,
+    _origin_namespace,
+    resolve_portable_state_dir,
+)
+from .system_credential_store import resolve_system_credential_store
+
+AUTO_SECURE_STORE = object()
+
+
+def resolve_legacy_state_dirs(platform, env=None, home_dir=None):
+    environment = os.environ if env is None else env
+    home = str(Path.home() if home_dir is None else home_dir).strip()
+    if not home:
+        raise ValueError("Unable to resolve the current user home directory")
+    if platform == "darwin":
+        return [os.path.join(
+            home, "Library", "Application Support", "TokensMind", "AgentNetwork",
+        )]
+    if platform == "win32":
+        local_app_data = str(environment.get("LOCALAPPDATA", "")).strip()
+        if not local_app_data:
+            return []
+        import ntpath
+        return [ntpath.join(local_app_data, "TokensMind", "AgentNetwork")]
+    if platform != "linux":
+        return []
+    default_dir = os.path.join(home, ".local", "state", "tokensmind", "agent-network")
+    xdg_state_home = str(environment.get("XDG_STATE_HOME", "")).strip()
+    directories = (
+        [os.path.join(xdg_state_home, "tokensmind", "agent-network"), default_dir]
+        if xdg_state_home else [default_dir]
+    )
+    return list(dict.fromkeys(directories))
+
+
+def _collect_source_records(sources):
+    candidates = {}
+    for source in sources:
+        for name in RECORD_NAMES:
+            value = source.read(name)
+            if value is None:
+                continue
+            if name in candidates and candidates[name]["value"] != value:
+                raise ValueError(
+                    "Conflicting Agent Network %s records exist in known local stores" % name,
+                )
+            candidate = candidates.setdefault(name, {"value": value, "sources": []})
+            candidate["sources"].append(source)
+    return candidates
+
+
+def _validate_migration_target(target, candidates):
+    missing = []
+    for name, candidate in candidates.items():
+        current = target.read(name)
+        if current is None:
+            missing.append((name, candidate["value"]))
+        elif current != candidate["value"]:
+            raise ValueError(
+                "Stored Agent Network %s conflicts with a known legacy record" % name,
+            )
+    return missing
+
+
+def migrate_credential_stores(target, sources):
+    candidates = _collect_source_records(sources)
+    if not candidates:
+        return
+    for name, value in _validate_migration_target(target, candidates):
+        target.write(name, value)
+    for name, candidate in candidates.items():
+        if target.read(name) != candidate["value"]:
+            raise RuntimeError("Agent Network %s migration could not be verified" % name)
+    for name, candidate in candidates.items():
+        for source in candidate["sources"]:
+            source.remove(name)
+
+
+def _file_stores(options):
+    return [
+        PortableStore(
+            origin=options["origin"],
+            platform=options["platform"],
+            state_dir=directory,
+            env=options["env"],
+            home_dir=options["home_dir"],
+        )
+        for directory in options["directories"]
+    ]
+
+
+def create_credential_store(
+        origin, platform, *, state_dir=None, env=None, home_dir=None,
+        secure_store=AUTO_SECURE_STORE,
+        secure_store_resolver=resolve_system_credential_store,
+        command_runner=None):
+    environment = os.environ if env is None else env
+    if state_dir:
+        return PortableStore(
+            origin, platform, state_dir, env=environment, home_dir=home_dir,
+        )
+    fallback_dir = resolve_portable_state_dir(platform, environment, home_dir)
+    fallback = PortableStore(
+        origin, platform, fallback_dir, env=environment, home_dir=home_dir,
+    )
+    if secure_store is AUTO_SECURE_STORE:
+        resolver_options = {
+            "platform": platform,
+            "namespace": _origin_namespace(origin),
+            "env": environment,
+        }
+        if command_runner is not None:
+            resolver_options["runner"] = command_runner
+        system_store = secure_store_resolver(**resolver_options)
+    else:
+        system_store = secure_store
+    target = system_store or fallback
+    source_dirs = []
+    if system_store:
+        source_dirs.append(fallback_dir)
+    source_dirs.extend(resolve_legacy_state_dirs(platform, environment, home_dir))
+    sources = _file_stores({
+        "directories": list(dict.fromkeys(source_dirs)),
+        "origin": origin,
+        "platform": platform,
+        "env": environment,
+        "home_dir": home_dir,
+    })
+    migrate_credential_stores(target, sources)
+    return target

package/skills/tokensmind-agent-network-runtime/scripts/python_runtime/crypto.py

@@ -0,0 +1,28 @@
+import base64
+import hashlib
+import secrets
+import uuid
+
+
+def sha256(value):
+    return hashlib.sha256(value.encode("utf-8")).hexdigest()
+
+
+def _random_credential(prefix):
+    encoded = base64.urlsafe_b64encode(secrets.token_bytes(32)).decode("ascii").rstrip("=")
+    return prefix + encoded
+
+
+def create_authorization_material(device_prefix, token_prefix):
+    device_code = _random_credential(device_prefix)
+    token = _random_credential(token_prefix)
+    return {
+        "authorizationId": str(uuid.uuid4()),
+        "createIdempotencyKey": str(uuid.uuid4()),
+        "exchangeIdempotencyKey": str(uuid.uuid4()),
+        "deviceCode": device_code,
+        "deviceCodeHash": sha256(device_code),
+        "token": token,
+        "tokenHash": sha256(token),
+        "tokenPrefix": token[:20],
+    }

package/skills/tokensmind-agent-network-runtime/scripts/python_runtime/device_authorization.py

@@ -0,0 +1,165 @@
+import time
+from urllib.parse import quote, urlsplit
+
+from .constants import AGENT_TOKEN_PREFIX, DEVICE_AUTHORIZATION_PATH, DEVICE_CODE_PREFIX
+from .crypto import create_authorization_material
+from .errors import AgentNetworkHttpError
+from .portable_store import parse_datetime_millis
+
+DEVICE_STATUSES = frozenset(("pending", "approved", "denied", "expired", "exchanged"))
+CLIENT_FIELDS = ("name", "version", "deviceName", "platform")
+
+
+def _headers(bearer=None, idempotency_key=None):
+    result = {"Content-Type": "application/json"}
+    if bearer:
+        result["Authorization"] = "Bearer %s" % bearer
+    if idempotency_key:
+        result["Idempotency-Key"] = idempotency_key
+    return result
+
+
+def _assert_client_metadata(client):
+    if not isinstance(client, dict):
+        raise ValueError("Agent Network client metadata is incomplete")
+    if any(not isinstance(client.get(field), str) or not client[field].strip()
+           for field in CLIENT_FIELDS):
+        raise ValueError("Agent Network client metadata is incomplete")
+
+
+def _assert_create_identity(response, pending):
+    if not isinstance(response, dict) or response.get("authorizationId") != pending["authorizationId"]:
+        raise ValueError("Agent Network authorization response has a mismatched identifier")
+
+
+def _assert_verification_url(response, pending, base_url):
+    parsed = urlsplit(str(response.get("verificationUrl", "")))
+    expected_path = "/console/agent-network/authorize/%s" % quote(pending["authorizationId"], safe="")
+    origin = "%s://%s" % (parsed.scheme, parsed.netloc)
+    if origin != base_url or parsed.path != expected_path or parsed.query or parsed.fragment:
+        raise ValueError("Agent Network returned an invalid verification URL")
+
+
+def _assert_authorization_timing(response):
+    try:
+        expires_at = parse_datetime_millis(response.get("expiresAt"))
+    except ValueError as error:
+        raise ValueError("Agent Network returned an invalid authorization expiry") from error
+    if expires_at <= int(time.time() * 1000):
+        raise ValueError("Agent Network returned an invalid authorization expiry")
+    interval = response.get("intervalSeconds")
+    if not isinstance(interval, int) or isinstance(interval, bool) or interval <= 0:
+        raise ValueError("Agent Network returned an invalid polling interval")
+    if not isinstance(response.get("userCode"), str) or not response["userCode"]:
+        raise ValueError("Agent Network authorization response is missing its user code")
+
+
+def _assert_create_response(response, pending, base_url):
+    _assert_create_identity(response, pending)
+    _assert_verification_url(response, pending, base_url)
+    _assert_authorization_timing(response)
+
+
+def _assert_status_response(status, pending):
+    if not isinstance(status, dict):
+        raise ValueError("Agent Network returned an invalid authorization status")
+    if status.get("authorizationId") != pending["authorizationId"]:
+        raise ValueError("Agent Network returned an invalid authorization status")
+    if status.get("status") not in DEVICE_STATUSES:
+        raise ValueError("Agent Network returned an invalid authorization status")
+    actual = parse_datetime_millis(status.get("expiresAt"))
+    expected = parse_datetime_millis(pending["authorization"]["expiresAt"])
+    if actual != expected:
+        raise ValueError("Agent Network authorization expiry changed unexpectedly")
+
+
+def _exchange_credential(exchange, pending):
+    if not isinstance(exchange, dict) or exchange.get("status") != "exchanged":
+        raise ValueError("Agent Network credential exchange did not complete")
+    if exchange.get("authorizationId") != pending["authorizationId"]:
+        raise ValueError("Agent Network credential exchange has a mismatched identifier")
+    credential = exchange.get("credential")
+    if not isinstance(credential, dict):
+        raise ValueError("Agent Network exchange response is missing credential metadata")
+    return credential
+
+
+def _assert_exchange(exchange, pending):
+    credential = _exchange_credential(exchange, pending)
+    if credential.get("tokenPrefix") != pending["tokenPrefix"]:
+        raise ValueError("Agent Network credential prefix verification failed")
+    agent = exchange.get("agent")
+    agent_id = agent.get("id") if isinstance(agent, dict) else None
+    if not credential.get("id") or credential.get("agentId") != agent_id:
+        raise ValueError("Agent Network exchange response is missing credential metadata")
+    forbidden = "apiToken" in exchange or "tokenHash" in credential or "apiToken" in credential
+    if forbidden:
+        raise ValueError("Agent Network exchange response exposed forbidden credential material")
+
+
+def create_pending_authorization(operation, instance_id):
+    pending = {"phase": "prepared", "operation": operation, "instanceId": instance_id}
+    pending.update(create_authorization_material(DEVICE_CODE_PREFIX, AGENT_TOKEN_PREFIX))
+    return pending
+
+
+def create_remote_authorization(pending, base_url, http, *, client):
+    _assert_client_metadata(client)
+    client_metadata = dict(client)
+    client_metadata["instanceId"] = pending["instanceId"]
+    response = http.request(
+        base_url + DEVICE_AUTHORIZATION_PATH,
+        method="POST",
+        headers=_headers(idempotency_key=pending["createIdempotencyKey"]),
+        body={
+            "authorizationId": pending["authorizationId"],
+            "deviceCodeHash": pending["deviceCodeHash"],
+            "client": client_metadata,
+            "credential": {
+                "tokenHash": pending["tokenHash"],
+                "tokenPrefix": pending["tokenPrefix"],
+            },
+        },
+    )
+    _assert_create_response(response, pending, base_url)
+    updated = dict(pending)
+    updated.update({"phase": "authorizing", "authorization": response})
+    return updated
+
+
+def wait_for_approval(pending, base_url, http):
+    expiry = parse_datetime_millis(pending["authorization"]["expiresAt"])
+    interval = pending["authorization"]["intervalSeconds"]
+    url = "%s%s/%s" % (base_url, DEVICE_AUTHORIZATION_PATH, pending["authorizationId"])
+    while int(time.time() * 1000) < expiry:
+        status = http.request(url, headers=_headers(bearer=pending["deviceCode"]))
+        _assert_status_response(status, pending)
+        if status["status"] in ("approved", "exchanged"):
+            return status
+        if status["status"] != "pending":
+            denied = status["status"] == "denied"
+            raise AgentNetworkHttpError(
+                403 if denied else 410,
+                "DEVICE_AUTHORIZATION_DENIED" if denied else "DEVICE_AUTHORIZATION_EXPIRED",
+                "Agent Network authorization ended with status %s" % status["status"],
+            )
+        time.sleep(interval)
+    raise AgentNetworkHttpError(
+        410, "DEVICE_AUTHORIZATION_EXPIRED", "Agent Network authorization expired",
+    )
+
+
+def exchange_authorization(pending, base_url, http):
+    url = "%s%s/%s/exchange" % (
+        base_url, DEVICE_AUTHORIZATION_PATH, pending["authorizationId"],
+    )
+    exchange = http.request(
+        url,
+        method="POST",
+        headers=_headers(
+            bearer=pending["deviceCode"],
+            idempotency_key=pending["exchangeIdempotencyKey"],
+        ),
+    )
+    _assert_exchange(exchange, pending)
+    return exchange

package/skills/tokensmind-agent-network-runtime/scripts/python_runtime/errors.py

@@ -0,0 +1,9 @@
+class AgentNetworkHttpError(Exception):
+    def __init__(self, status, code=None, message=None, *, response=None, headers=None):
+        super().__init__(message or "Agent Network request failed with HTTP %s" % status)
+        self.status = status
+        self.code = code
+        self.response = response
+        self.headers = headers or {}
+        self.correction = response.get("correction") if isinstance(response, dict) else None
+        self.retry_after = self.headers.get("retryAfter")

package/skills/tokensmind-agent-network-runtime/scripts/python_runtime/http_client.py

@@ -0,0 +1,50 @@
+import json
+from urllib.error import HTTPError
+from urllib.request import Request, urlopen
+
+from .errors import AgentNetworkHttpError
+
+UNSET = object()
+
+
+def _parse_response(source, status):
+    if not source:
+        return None
+    try:
+        return json.loads(source.decode("utf-8"))
+    except (UnicodeDecodeError, json.JSONDecodeError) as error:
+        raise ValueError("Agent Network returned non-JSON HTTP %s" % status) from error
+
+
+def _unwrap_response(payload, status, successful, *, headers=None):
+    if successful and isinstance(payload, dict):
+        if payload.get("success") is True and "data" in payload:
+            return payload["data"]
+        raise ValueError("Agent Network returned an invalid success response envelope")
+    if successful:
+        raise ValueError("Agent Network returned an invalid success response envelope")
+    code = payload.get("code") if isinstance(payload, dict) else None
+    message = payload.get("message") if isinstance(payload, dict) else None
+    raise AgentNetworkHttpError(status, code, message, response=payload, headers=headers)
+
+
+class HttpClient:
+    def __init__(self, opener=urlopen):
+        self._opener = opener
+
+    def request(self, url, method="GET", headers=None, *, body=UNSET):
+        data = None
+        if body is not UNSET:
+            data = json.dumps(body, separators=(",", ":")).encode("utf-8")
+        request = Request(url, data=data, headers=headers or {}, method=method)
+        try:
+            response = self._opener(request)
+            with response:
+                status = response.getcode()
+                headers = {"retryAfter": response.headers.get("Retry-After")}
+                payload = _parse_response(response.read(), status)
+            return _unwrap_response(payload, status, 200 <= status < 300, headers=headers)
+        except HTTPError as error:
+            headers = {"retryAfter": error.headers.get("Retry-After")}
+            payload = _parse_response(error.read(), error.code)
+            return _unwrap_response(payload, error.code, False, headers=headers)