@truefoundry/trueforge-sdk 0.0.0 → 0.1.0-rc.1

package/dist/cjs/core/fetcher/getFetchFn.js

@@ -0,0 +1,17 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getFetchFn = getFetchFn;
+function getFetchFn() {
+    return __awaiter(this, void 0, void 0, function* () {
+        return fetch;
+    });
+}

package/dist/cjs/core/fetcher/getHeader.d.ts

@@ -0,0 +1 @@
+export declare function getHeader(headers: Record<string, any>, header: string): string | undefined;

package/dist/cjs/core/fetcher/getHeader.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getHeader = getHeader;
+function getHeader(headers, header) {
+    for (const [headerKey, headerValue] of Object.entries(headers)) {
+        if (headerKey.toLowerCase() === header.toLowerCase()) {
+            return headerValue;
+        }
+    }
+    return undefined;
+}

package/dist/cjs/core/fetcher/getRequestBody.d.ts

@@ -0,0 +1,7 @@
+export declare namespace GetRequestBody {
+    interface Args {
+        body: unknown;
+        type: "json" | "file" | "bytes" | "form" | "other";
+    }
+}
+export declare function getRequestBody({ body, type }: GetRequestBody.Args): Promise<BodyInit | undefined>;

package/dist/cjs/core/fetcher/getRequestBody.js

@@ -0,0 +1,27 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getRequestBody = getRequestBody;
+const json_js_1 = require("../json.js");
+const qs_js_1 = require("../url/qs.js");
+function getRequestBody(_a) {
+    return __awaiter(this, arguments, void 0, function* ({ body, type }) {
+        if (type === "form") {
+            return (0, qs_js_1.toQueryString)(body, { arrayFormat: "repeat", encode: true });
+        }
+        if (type.includes("json")) {
+            return (0, json_js_1.toJson)(body);
+        }
+        else {
+            return body;
+        }
+    });
+}

package/dist/cjs/core/fetcher/getResponseBody.d.ts

@@ -0,0 +1 @@
+export declare function getResponseBody(response: Response, responseType?: string): Promise<unknown>;

package/dist/cjs/core/fetcher/getResponseBody.js

@@ -0,0 +1,80 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getResponseBody = getResponseBody;
+const json_js_1 = require("../json.js");
+const BinaryResponse_js_1 = require("./BinaryResponse.js");
+// Pins the upstream Response so undici's FinalizationRegistry can't GC it and cancel the body stream.
+function retainResponse(target, response) {
+    Object.defineProperty(target, "__fern_response_ref", {
+        value: response,
+        enumerable: false,
+        configurable: true,
+        writable: false,
+    });
+}
+function getResponseBody(response, responseType) {
+    return __awaiter(this, void 0, void 0, function* () {
+        switch (responseType) {
+            case "binary-response":
+                return (0, BinaryResponse_js_1.getBinaryResponse)(response);
+            case "blob":
+                return yield response.blob();
+            case "arrayBuffer":
+                return yield response.arrayBuffer();
+            case "sse":
+                if (response.body == null) {
+                    return {
+                        ok: false,
+                        error: {
+                            reason: "body-is-null",
+                            statusCode: response.status,
+                        },
+                    };
+                }
+                retainResponse(response.body, response);
+                return response.body;
+            case "streaming":
+                if (response.body == null) {
+                    return {
+                        ok: false,
+                        error: {
+                            reason: "body-is-null",
+                            statusCode: response.status,
+                        },
+                    };
+                }
+                retainResponse(response.body, response);
+                return response.body;
+            case "text":
+                return yield response.text();
+        }
+        // if responseType is "json" or not specified, try to parse as JSON
+        const text = yield response.text();
+        if (text.length > 0) {
+            try {
+                const responseBody = (0, json_js_1.fromJson)(text);
+                return responseBody;
+            }
+            catch (_err) {
+                return {
+                    ok: false,
+                    error: {
+                        reason: "non-json",
+                        statusCode: response.status,
+                        rawBody: text,
+                    },
+                };
+            }
+        }
+        return undefined;
+    });
+}

package/dist/cjs/core/fetcher/index.d.ts

@@ -0,0 +1,13 @@
+export type { APIResponse } from "./APIResponse.js";
+export type { BinaryResponse } from "./BinaryResponse.js";
+export type { EndpointMetadata } from "./EndpointMetadata.js";
+export { EndpointSupplier } from "./EndpointSupplier.js";
+export type { Fetcher, FetchFunction } from "./Fetcher.js";
+export { fetcher } from "./Fetcher.js";
+export { getHeader } from "./getHeader.js";
+export { HttpResponsePromise } from "./HttpResponsePromise.js";
+export type { PassthroughRequest } from "./makePassthroughRequest.js";
+export { makePassthroughRequest } from "./makePassthroughRequest.js";
+export type { RawResponse, WithRawResponse } from "./RawResponse.js";
+export { abortRawResponse, toRawResponse, unknownRawResponse } from "./RawResponse.js";
+export { Supplier } from "./Supplier.js";

package/dist/cjs/core/fetcher/index.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Supplier = exports.unknownRawResponse = exports.toRawResponse = exports.abortRawResponse = exports.makePassthroughRequest = exports.HttpResponsePromise = exports.getHeader = exports.fetcher = exports.EndpointSupplier = void 0;
+var EndpointSupplier_js_1 = require("./EndpointSupplier.js");
+Object.defineProperty(exports, "EndpointSupplier", { enumerable: true, get: function () { return EndpointSupplier_js_1.EndpointSupplier; } });
+var Fetcher_js_1 = require("./Fetcher.js");
+Object.defineProperty(exports, "fetcher", { enumerable: true, get: function () { return Fetcher_js_1.fetcher; } });
+var getHeader_js_1 = require("./getHeader.js");
+Object.defineProperty(exports, "getHeader", { enumerable: true, get: function () { return getHeader_js_1.getHeader; } });
+var HttpResponsePromise_js_1 = require("./HttpResponsePromise.js");
+Object.defineProperty(exports, "HttpResponsePromise", { enumerable: true, get: function () { return HttpResponsePromise_js_1.HttpResponsePromise; } });
+var makePassthroughRequest_js_1 = require("./makePassthroughRequest.js");
+Object.defineProperty(exports, "makePassthroughRequest", { enumerable: true, get: function () { return makePassthroughRequest_js_1.makePassthroughRequest; } });
+var RawResponse_js_1 = require("./RawResponse.js");
+Object.defineProperty(exports, "abortRawResponse", { enumerable: true, get: function () { return RawResponse_js_1.abortRawResponse; } });
+Object.defineProperty(exports, "toRawResponse", { enumerable: true, get: function () { return RawResponse_js_1.toRawResponse; } });
+Object.defineProperty(exports, "unknownRawResponse", { enumerable: true, get: function () { return RawResponse_js_1.unknownRawResponse; } });
+var Supplier_js_1 = require("./Supplier.js");
+Object.defineProperty(exports, "Supplier", { enumerable: true, get: function () { return Supplier_js_1.Supplier; } });

package/dist/cjs/core/fetcher/makePassthroughRequest.d.ts

@@ -0,0 +1,49 @@
+import { type LogConfig, type Logger } from "../logging/logger.js";
+import { Supplier } from "./Supplier.js";
+export declare namespace PassthroughRequest {
+    /**
+     * Per-request options that can override the SDK client defaults.
+     */
+    interface RequestOptions {
+        /** Override the default timeout for this request (in seconds). */
+        timeoutInSeconds?: number;
+        /** Override the default number of retries for this request. */
+        maxRetries?: number;
+        /** Additional headers to include in this request. */
+        headers?: Record<string, string>;
+        /** Abort signal for this request. */
+        abortSignal?: AbortSignal;
+    }
+    /**
+     * SDK client configuration used by the passthrough fetch method.
+     */
+    interface ClientOptions {
+        /** The base URL or environment for the client. */
+        environment?: Supplier<string>;
+        /** Override the base URL. */
+        baseUrl?: Supplier<string>;
+        /** Default headers to include in requests. */
+        headers?: Record<string, unknown>;
+        /** Default maximum time to wait for a response in seconds. */
+        timeoutInSeconds?: number;
+        /** Default number of times to retry the request. Defaults to 2. */
+        maxRetries?: number;
+        /** A custom fetch function. */
+        fetch?: typeof fetch;
+        /** Logging configuration. */
+        logging?: LogConfig | Logger;
+        /** A function that returns auth headers. */
+        getAuthHeaders?: () => Promise<Record<string, string>>;
+    }
+}
+/**
+ * Makes a passthrough HTTP request using the SDK's configuration (auth, retry, logging, etc.)
+ * while mimicking the standard `fetch` API.
+ *
+ * @param input - The URL, path, or Request object. If a relative path, it will be resolved against the configured base URL.
+ * @param init - Standard RequestInit options (method, headers, body, signal, etc.)
+ * @param clientOptions - SDK client options (auth, default headers, logging, etc.)
+ * @param requestOptions - Per-request overrides (timeout, retries, extra headers, abort signal).
+ * @returns A standard Response object.
+ */
+export declare function makePassthroughRequest(input: Request | string | URL, init: RequestInit | undefined, clientOptions: PassthroughRequest.ClientOptions, requestOptions?: PassthroughRequest.RequestOptions): Promise<Response>;

package/dist/cjs/core/fetcher/makePassthroughRequest.js

@@ -0,0 +1,157 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.makePassthroughRequest = makePassthroughRequest;
+const logger_js_1 = require("../logging/logger.js");
+const join_js_1 = require("../url/join.js");
+const EndpointSupplier_js_1 = require("./EndpointSupplier.js");
+const getFetchFn_js_1 = require("./getFetchFn.js");
+const makeRequest_js_1 = require("./makeRequest.js");
+const redactUrl_js_1 = require("./redactUrl.js");
+const requestWithRetries_js_1 = require("./requestWithRetries.js");
+const Supplier_js_1 = require("./Supplier.js");
+/**
+ * Makes a passthrough HTTP request using the SDK's configuration (auth, retry, logging, etc.)
+ * while mimicking the standard `fetch` API.
+ *
+ * @param input - The URL, path, or Request object. If a relative path, it will be resolved against the configured base URL.
+ * @param init - Standard RequestInit options (method, headers, body, signal, etc.)
+ * @param clientOptions - SDK client options (auth, default headers, logging, etc.)
+ * @param requestOptions - Per-request overrides (timeout, retries, extra headers, abort signal).
+ * @returns A standard Response object.
+ */
+function makePassthroughRequest(input, init, clientOptions, requestOptions) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c, _d, _e, _f, _g;
+        const logger = (0, logger_js_1.createLogger)(clientOptions.logging);
+        // Extract URL and default init properties from Request object if provided
+        let url;
+        let effectiveInit = init;
+        if (input instanceof Request) {
+            url = input.url;
+            // If no explicit init provided, extract properties from the Request object
+            if (init == null) {
+                effectiveInit = {
+                    method: input.method,
+                    headers: Object.fromEntries(input.headers.entries()),
+                    body: input.body,
+                    signal: input.signal,
+                    credentials: input.credentials,
+                    cache: input.cache,
+                    redirect: input.redirect,
+                    referrer: input.referrer,
+                    integrity: input.integrity,
+                    mode: input.mode,
+                };
+            }
+        }
+        else {
+            url = input instanceof URL ? input.toString() : input;
+        }
+        // Resolve the base URL
+        const baseUrl = (_a = (clientOptions.baseUrl != null ? yield Supplier_js_1.Supplier.get(clientOptions.baseUrl) : undefined)) !== null && _a !== void 0 ? _a : (clientOptions.environment != null ? yield Supplier_js_1.Supplier.get(clientOptions.environment) : undefined);
+        // Determine the full URL
+        let fullUrl;
+        if (url.startsWith("http://") || url.startsWith("https://")) {
+            fullUrl = url;
+        }
+        else if (baseUrl != null) {
+            fullUrl = (0, join_js_1.join)(baseUrl, url);
+        }
+        else {
+            fullUrl = url;
+        }
+        // Merge headers: SDK default headers -> auth headers -> user-provided headers
+        const mergedHeaders = {};
+        // Apply SDK default headers (resolve suppliers)
+        if (clientOptions.headers != null) {
+            for (const [key, value] of Object.entries(clientOptions.headers)) {
+                const resolved = yield EndpointSupplier_js_1.EndpointSupplier.get(value, { endpointMetadata: {} });
+                if (resolved != null) {
+                    mergedHeaders[key.toLowerCase()] = `${resolved}`;
+                }
+            }
+        }
+        // Apply auth headers, but only when the resolved URL targets the configured base URL.
+        // This prevents the SDK's credentials from leaking to an unrelated host when a caller
+        // passes an absolute cross-origin URL into the passthrough fetch escape hatch.
+        if (clientOptions.getAuthHeaders != null && targetsBaseUrl(fullUrl, baseUrl)) {
+            const authHeaders = yield clientOptions.getAuthHeaders();
+            for (const [key, value] of Object.entries(authHeaders)) {
+                mergedHeaders[key.toLowerCase()] = value;
+            }
+        }
+        // Apply user-provided headers from init
+        if ((effectiveInit === null || effectiveInit === void 0 ? void 0 : effectiveInit.headers) != null) {
+            const initHeaders = effectiveInit.headers instanceof Headers
+                ? Object.fromEntries(effectiveInit.headers.entries())
+                : Array.isArray(effectiveInit.headers)
+                    ? Object.fromEntries(effectiveInit.headers)
+                    : effectiveInit.headers;
+            for (const [key, value] of Object.entries(initHeaders)) {
+                if (value != null) {
+                    mergedHeaders[key.toLowerCase()] = value;
+                }
+            }
+        }
+        // Apply per-request option headers (highest priority)
+        if ((requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.headers) != null) {
+            for (const [key, value] of Object.entries(requestOptions.headers)) {
+                mergedHeaders[key.toLowerCase()] = value;
+            }
+        }
+        const method = (_b = effectiveInit === null || effectiveInit === void 0 ? void 0 : effectiveInit.method) !== null && _b !== void 0 ? _b : "GET";
+        const body = effectiveInit === null || effectiveInit === void 0 ? void 0 : effectiveInit.body;
+        const timeoutInSeconds = (_c = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.timeoutInSeconds) !== null && _c !== void 0 ? _c : clientOptions.timeoutInSeconds;
+        const timeoutMs = timeoutInSeconds != null ? timeoutInSeconds * 1000 : undefined;
+        const maxRetries = (_d = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.maxRetries) !== null && _d !== void 0 ? _d : clientOptions.maxRetries;
+        const abortSignal = (_f = (_e = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.abortSignal) !== null && _e !== void 0 ? _e : effectiveInit === null || effectiveInit === void 0 ? void 0 : effectiveInit.signal) !== null && _f !== void 0 ? _f : undefined;
+        const fetchFn = (_g = clientOptions.fetch) !== null && _g !== void 0 ? _g : (yield (0, getFetchFn_js_1.getFetchFn)());
+        if (logger.isDebug()) {
+            logger.debug("Making passthrough HTTP request", {
+                method,
+                url: (0, redactUrl_js_1.redactUrl)(fullUrl),
+                hasBody: body != null,
+            });
+        }
+        const response = yield (0, requestWithRetries_js_1.requestWithRetries)(() => __awaiter(this, void 0, void 0, function* () {
+            return (0, makeRequest_js_1.makeRequest)(fetchFn, fullUrl, method, mergedHeaders, body !== null && body !== void 0 ? body : undefined, timeoutMs, abortSignal, (effectiveInit === null || effectiveInit === void 0 ? void 0 : effectiveInit.credentials) === "include", undefined, // duplex
+            false);
+        }), maxRetries);
+        if (logger.isDebug()) {
+            logger.debug("Passthrough HTTP request completed", {
+                method,
+                url: (0, redactUrl_js_1.redactUrl)(fullUrl),
+                statusCode: response.status,
+            });
+        }
+        return response;
+    });
+}
+/**
+ * Returns true when the resolved request URL points at the same origin as the
+ * configured base URL. Relative paths are always joined onto the base URL, so
+ * they resolve to the base origin and return true. Absolute URLs only match when
+ * their origin equals the base origin. When there is no base URL to compare
+ * against, or either value is not a parseable absolute URL, this returns false so
+ * auth headers are not attached.
+ */
+function targetsBaseUrl(fullUrl, baseUrl) {
+    if (baseUrl == null) {
+        return false;
+    }
+    try {
+        return new URL(fullUrl).origin === new URL(baseUrl).origin;
+    }
+    catch (_a) {
+        return false;
+    }
+}

package/dist/cjs/core/fetcher/makeRequest.d.ts

@@ -0,0 +1,6 @@
+export declare function isCacheNoStoreSupported(): boolean;
+/**
+ * Reset the cached result of `isCacheNoStoreSupported`. Exposed for testing only.
+ */
+export declare function resetCacheNoStoreSupported(): void;
+export declare const makeRequest: (fetchFn: (url: string, init: RequestInit) => Promise<Response>, url: string, method: string, headers: Headers | Record<string, string>, requestBody: BodyInit | undefined, timeoutMs?: number, abortSignal?: AbortSignal, withCredentials?: boolean, duplex?: "half", disableCache?: boolean) => Promise<Response>;

package/dist/cjs/core/fetcher/makeRequest.js

@@ -0,0 +1,61 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.makeRequest = void 0;
+exports.isCacheNoStoreSupported = isCacheNoStoreSupported;
+exports.resetCacheNoStoreSupported = resetCacheNoStoreSupported;
+const signals_js_1 = require("./signals.js");
+/**
+ * Cached result of checking whether the current runtime supports
+ * the `cache` option in `Request`. Some runtimes (e.g. Cloudflare Workers)
+ * throw a TypeError when this option is used.
+ */
+let _cacheNoStoreSupported;
+function isCacheNoStoreSupported() {
+    if (_cacheNoStoreSupported != null) {
+        return _cacheNoStoreSupported;
+    }
+    try {
+        new Request("http://localhost", { cache: "no-store" });
+        _cacheNoStoreSupported = true;
+    }
+    catch (_a) {
+        _cacheNoStoreSupported = false;
+    }
+    return _cacheNoStoreSupported;
+}
+/**
+ * Reset the cached result of `isCacheNoStoreSupported`. Exposed for testing only.
+ */
+function resetCacheNoStoreSupported() {
+    _cacheNoStoreSupported = undefined;
+}
+const makeRequest = (fetchFn, url, method, headers, requestBody, timeoutMs, abortSignal, withCredentials, duplex, disableCache) => __awaiter(void 0, void 0, void 0, function* () {
+    const signals = [];
+    let timeoutAbortId;
+    if (timeoutMs != null) {
+        const { signal, abortId } = (0, signals_js_1.getTimeoutSignal)(timeoutMs);
+        timeoutAbortId = abortId;
+        signals.push(signal);
+    }
+    if (abortSignal != null) {
+        signals.push(abortSignal);
+    }
+    const newSignals = (0, signals_js_1.anySignal)(signals);
+    const response = yield fetchFn(url, Object.assign({ method: method, headers, body: requestBody, signal: newSignals, credentials: withCredentials ? "include" : undefined, 
+        // @ts-ignore
+        duplex }, (disableCache && isCacheNoStoreSupported() ? { cache: "no-store" } : {})));
+    if (timeoutAbortId != null) {
+        clearTimeout(timeoutAbortId);
+    }
+    return response;
+});
+exports.makeRequest = makeRequest;

package/dist/cjs/core/fetcher/redactUrl.d.ts

@@ -0,0 +1,2 @@
+export declare const SENSITIVE_QUERY_PARAMS: Set<string>;
+export declare function redactUrl(url: string): string;

package/dist/cjs/core/fetcher/redactUrl.js

@@ -0,0 +1,88 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SENSITIVE_QUERY_PARAMS = void 0;
+exports.redactUrl = redactUrl;
+exports.SENSITIVE_QUERY_PARAMS = new Set([
+    "api_key",
+    "api-key",
+    "apikey",
+    "token",
+    "access_token",
+    "access-token",
+    "auth_token",
+    "auth-token",
+    "password",
+    "passwd",
+    "secret",
+    "api_secret",
+    "api-secret",
+    "apisecret",
+    "key",
+    "session",
+    "session_id",
+    "session-id",
+]);
+function redactUrl(url) {
+    const protocolIndex = url.indexOf("://");
+    if (protocolIndex === -1)
+        return url;
+    const afterProtocol = protocolIndex + 3;
+    // Find the first delimiter that marks the end of the authority section
+    const pathStart = url.indexOf("/", afterProtocol);
+    let queryStart = url.indexOf("?", afterProtocol);
+    let fragmentStart = url.indexOf("#", afterProtocol);
+    const firstDelimiter = Math.min(pathStart === -1 ? url.length : pathStart, queryStart === -1 ? url.length : queryStart, fragmentStart === -1 ? url.length : fragmentStart);
+    // Find the LAST @ before the delimiter (handles multiple @ in credentials)
+    let atIndex = -1;
+    for (let i = afterProtocol; i < firstDelimiter; i++) {
+        if (url[i] === "@") {
+            atIndex = i;
+        }
+    }
+    if (atIndex !== -1) {
+        url = `${url.slice(0, afterProtocol)}[REDACTED]@${url.slice(atIndex + 1)}`;
+    }
+    // Recalculate queryStart since url might have changed
+    queryStart = url.indexOf("?");
+    if (queryStart === -1)
+        return url;
+    fragmentStart = url.indexOf("#", queryStart);
+    const queryEnd = fragmentStart !== -1 ? fragmentStart : url.length;
+    const queryString = url.slice(queryStart + 1, queryEnd);
+    if (queryString.length === 0)
+        return url;
+    // FAST PATH: Quick check if any sensitive keywords present
+    // Using indexOf is faster than regex for simple substring matching
+    const lower = queryString.toLowerCase();
+    const hasSensitive = lower.includes("token") ||
+        lower.includes("key") ||
+        lower.includes("password") ||
+        lower.includes("passwd") ||
+        lower.includes("secret") ||
+        lower.includes("session") ||
+        lower.includes("auth");
+    if (!hasSensitive) {
+        return url;
+    }
+    // SLOW PATH: Parse and redact
+    const redactedParams = [];
+    const params = queryString.split("&");
+    for (const param of params) {
+        const equalIndex = param.indexOf("=");
+        if (equalIndex === -1) {
+            redactedParams.push(param);
+            continue;
+        }
+        const key = param.slice(0, equalIndex);
+        let shouldRedact = exports.SENSITIVE_QUERY_PARAMS.has(key.toLowerCase());
+        if (!shouldRedact && key.includes("%")) {
+            try {
+                const decodedKey = decodeURIComponent(key);
+                shouldRedact = exports.SENSITIVE_QUERY_PARAMS.has(decodedKey.toLowerCase());
+            }
+            catch (_a) { }
+        }
+        redactedParams.push(shouldRedact ? `${key}=[REDACTED]` : param);
+    }
+    return url.slice(0, queryStart + 1) + redactedParams.join("&") + url.slice(queryEnd);
+}

package/dist/cjs/core/fetcher/requestWithRetries.d.ts

@@ -0,0 +1 @@
+export declare function requestWithRetries(requestFn: () => Promise<Response>, maxRetries?: number): Promise<Response>;

package/dist/cjs/core/fetcher/requestWithRetries.js

@@ -0,0 +1,70 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requestWithRetries = requestWithRetries;
+const INITIAL_RETRY_DELAY = 1000; // in milliseconds
+const MAX_RETRY_DELAY = 60000; // in milliseconds
+const DEFAULT_MAX_RETRIES = 2;
+const JITTER_FACTOR = 0.2; // 20% random jitter
+function isRetryableStatusCode(statusCode) {
+    return [408, 429].includes(statusCode) || statusCode >= 500;
+}
+function addPositiveJitter(delay) {
+    const jitterMultiplier = 1 + Math.random() * JITTER_FACTOR;
+    return delay * jitterMultiplier;
+}
+function addSymmetricJitter(delay) {
+    const jitterMultiplier = 1 + (Math.random() - 0.5) * JITTER_FACTOR;
+    return delay * jitterMultiplier;
+}
+function getRetryDelayFromHeaders(response, retryAttempt) {
+    const retryAfter = response.headers.get("Retry-After");
+    if (retryAfter) {
+        const retryAfterSeconds = parseInt(retryAfter, 10);
+        if (!Number.isNaN(retryAfterSeconds) && retryAfterSeconds > 0) {
+            return Math.min(retryAfterSeconds * 1000, MAX_RETRY_DELAY);
+        }
+        const retryAfterDate = new Date(retryAfter);
+        if (!Number.isNaN(retryAfterDate.getTime())) {
+            const delay = retryAfterDate.getTime() - Date.now();
+            if (delay > 0) {
+                return Math.min(Math.max(delay, 0), MAX_RETRY_DELAY);
+            }
+        }
+    }
+    const rateLimitReset = response.headers.get("X-RateLimit-Reset");
+    if (rateLimitReset) {
+        const resetTime = parseInt(rateLimitReset, 10);
+        if (!Number.isNaN(resetTime)) {
+            const delay = resetTime * 1000 - Date.now();
+            if (delay > 0) {
+                return addPositiveJitter(Math.min(delay, MAX_RETRY_DELAY));
+            }
+        }
+    }
+    return addSymmetricJitter(Math.min(INITIAL_RETRY_DELAY * Math.pow(2, retryAttempt), MAX_RETRY_DELAY));
+}
+function requestWithRetries(requestFn_1) {
+    return __awaiter(this, arguments, void 0, function* (requestFn, maxRetries = DEFAULT_MAX_RETRIES) {
+        let response = yield requestFn();
+        for (let i = 0; i < maxRetries; ++i) {
+            if (isRetryableStatusCode(response.status)) {
+                const delay = getRetryDelayFromHeaders(response, i);
+                yield new Promise((resolve) => setTimeout(resolve, delay));
+                response = yield requestFn();
+            }
+            else {
+                break;
+            }
+        }
+        return response;
+    });
+}

package/dist/cjs/core/fetcher/signals.d.ts

@@ -0,0 +1,5 @@
+export declare function getTimeoutSignal(timeoutMs: number): {
+    signal: AbortSignal;
+    abortId: ReturnType<typeof setTimeout>;
+};
+export declare function anySignal(...args: AbortSignal[] | [AbortSignal[]]): AbortSignal;