@typeship-ax/cli 0.6.0 → 0.9.1

package/dist/core/http.js

@@ -29,43 +29,21 @@ export class UnexpectedApiError extends ApiError {
         super("Unexpected HTTP status " + status, status, body, response);
     }
 }
-/** A 200 response whose GraphQL payload carried errors. */
-export class GraphQLRequestError extends Error {
-    /** The raw errors array from the GraphQL response. */
-    errors;
+/** A successful response declared JSON but carried a body that could not be parsed. */
+export class ResponseParseError extends Error {
+    status;
+    body;
     response;
-    constructor(errors, response) {
-        const first = errors[0]?.message;
-        super(first ?? "GraphQL request returned errors");
-        this.name = "GraphQLRequestError";
-        this.errors = errors;
+    cause;
+    constructor(body, response, cause) {
+        super("HTTP " + response.status + " response body was not valid JSON");
+        this.name = "ResponseParseError";
+        this.status = response.status;
+        this.body = body;
         this.response = response;
+        this.cause = cause;
     }
 }
-/** Serialize a selection object to a GraphQL selection set. Strings pass
- * through untouched. */
-export function selectionToString(selection) {
-    if (typeof selection === "string")
-        return selection;
-    const parts = [];
-    for (const [key, value] of Object.entries(selection)) {
-        if (!value)
-            continue;
-        if (key === "on" && typeof value === "object") {
-            for (const [typeName, sub] of Object.entries(value)) {
-                if (sub && typeof sub === "object")
-                    parts.push("... on " + typeName + " " + selectionToString(sub));
-            }
-        }
-        else if (value === true) {
-            parts.push(key);
-        }
-        else if (typeof value === "object") {
-            parts.push(key + " " + selectionToString(value));
-        }
-    }
-    return "{ " + (parts.length > 0 ? parts.join(" ") : "__typename") + " }";
-}
 /** Request or response data did not match the spec's schema (opt-in via the
  * client's validate option). Never thrown: returned as the error side of
  * ApiResult, like every other failure. */
@@ -211,7 +189,7 @@ function transportFailureMessage(method, url, cause) {
     }
     return method + " " + url + " failed: " + detail;
 }
-/** The request never produced an HTTP response (network failure, timeout, abort). */
+/** The request failed before a complete HTTP response arrived (network failure, timeout, abort, or truncated body). */
 export class TransportError extends Error {
     cause;
     constructor(message, cause) {
@@ -220,6 +198,33 @@ export class TransportError extends Error {
         this.cause = cause;
     }
 }
+/** Resolve one complete alternative in spec order. Missing or incompatible
+ * combinations contribute no partial credentials. Anonymous operations send
+ * no generated credentials; explicit headers/hooks remain application owned. */
+function selectSecurity(requirements, credentials) {
+    for (const requirement of requirements) {
+        const names = Object.keys(requirement);
+        if (!names.length || names.some((name) => !Object.hasOwn(credentials, name)))
+            continue;
+        const selected = { headers: Object.create(null), query: Object.create(null) };
+        const destinations = new Set();
+        let conflict = false;
+        for (const name of names) {
+            for (const location of ["headers", "query"]) {
+                for (const [wire, value] of Object.entries(credentials[name][location] ?? {})) {
+                    const destination = location + ":" + (location === "headers" ? wire.toLowerCase() : wire);
+                    if (destinations.has(destination))
+                        conflict = true;
+                    destinations.add(destination);
+                    selected[location][wire] = value;
+                }
+            }
+        }
+        if (!conflict)
+            return selected;
+    }
+    return {};
+}
 const RETRYABLE_STATUSES = new Set([408, 429, 500, 502, 503, 504]);
 /** Credential-bearing headers fetch itself drops when a redirect crosses to
  * another origin. A spec's own API-key headers join them below. */
@@ -269,8 +274,13 @@ export class HttpCore {
         const policy = { ...this.config.retry, ...req.retry };
         const maxRetries = req.options?.maxRetries ?? policy.maxRetries ?? this.config.maxRetries;
         const timeoutMs = req.options?.timeoutMs ?? this.config.timeoutMs;
-        const retryAllowed = req.idempotent === true || req.method === "GET" || policy.retryNonIdempotent === true;
-        const retryableStatuses = policy.statuses ? new Set(policy.statuses) : RETRYABLE_STATUSES;
+        const retryAllowed = req.idempotent === true ||
+            req.method === "GET" ||
+            req.idempotencyKey !== undefined ||
+            policy.retryNonIdempotent === true;
+        const retryableStatuses = policy.statuses
+            ? new Set(policy.statuses)
+            : RETRYABLE_STATUSES;
         // One key per logical call, reused on every retry — that's the point
         // of idempotency keys.
         const autoIdempotencyKey = req.idempotencyKey !== undefined &&
@@ -299,16 +309,19 @@ export class HttpCore {
         for (let attempt = 0; attempt <= maxRetries; attempt++) {
             let response;
             const attemptStarted = Date.now();
+            const emitResponseDebug = (value, body) => this.config.debug?.({
+                method: req.method,
+                path: req.path,
+                status: value.status,
+                durationMs: Date.now() - attemptStarted,
+                attempt: attempt + 1,
+                requestId: requestIdFromBody(body) ??
+                    value.headers.get("request-id") ??
+                    value.headers.get("x-request-id") ??
+                    undefined,
+            });
             try {
                 response = await this.send(req, timeoutMs, attempt, autoIdempotencyKey);
-                this.config.debug?.({
-                    method: req.method,
-                    path: req.path,
-                    status: response.status,
-                    durationMs: Date.now() - attemptStarted,
-                    attempt: attempt + 1,
-                    requestId: response.headers.get("x-request-id") ?? response.headers.get("request-id") ?? undefined,
-                });
             }
             catch (cause) {
                 lastError = cause;
@@ -328,21 +341,24 @@ export class HttpCore {
                 return { ok: false, error };
             }
             if (response.ok) {
-                if (req.stream) {
-                    return { ok: true, data: sseEvents(response), response: meta(response) };
-                }
                 let data;
                 try {
                     data = (await parseBody(response, req.method));
                 }
                 catch (cause) {
-                    const error = new TransportError("The response body read was aborted before completing", cause);
+                    const parseError = cause instanceof ResponseParseError ? cause : undefined;
+                    emitResponseDebug(response, parseError?.body);
+                    const error = (parseError ?? new TransportError("The response body read failed before completing", cause));
                     await this.config.onError?.(error, { method: req.method, path: req.path });
-                    return { ok: false, error, response: meta(response) };
+                    return { ok: false, error, response: parseError?.response ?? meta(response) };
                 }
-                if (opSchemas?.res && this.config.validate.responses && data !== undefined) {
+                emitResponseDebug(response, data);
+                const responseMeta = meta(response, data);
+                let responseData = data;
+                let shouldValidateResponse = responseData !== undefined;
+                if (opSchemas?.res && this.config.validate.responses && shouldValidateResponse) {
                     const violations = [];
-                    validateAgainstSchema(data, opSchemas.res, "response", violations, this.config.schemaDefs);
+                    validateAgainstSchema(responseData, opSchemas.res, "response", violations, this.config.schemaDefs);
                     if (violations.length > 0) {
                         const validationError = new ValidationError("response", violations);
                         if (this.config.validate.mode === "warn") {
@@ -351,28 +367,27 @@ export class HttpCore {
                         else {
                             const error = validationError;
                             await this.config.onError?.(error, { method: req.method, path: req.path });
-                            return { ok: false, error, response: meta(response) };
+                            return { ok: false, error, response: responseMeta };
                         }
                     }
                 }
-                if (req.graphqlField) {
-                    const payload = data;
-                    const responseMeta = meta(response);
-                    if (Array.isArray(payload?.errors) && payload.errors.length > 0) {
-                        const gqlError = new GraphQLRequestError(payload.errors, responseMeta);
-                        await this.config.onError?.(gqlError, { method: req.method, path: req.path });
-                        return { ok: false, error: gqlError, response: responseMeta };
-                    }
-                    return { ok: true, data: payload?.data?.[req.graphqlField], response: responseMeta };
-                }
-                return { ok: true, data, response: meta(response) };
+                return { ok: true, data, response: responseMeta };
             }
             // 429 is safe to retry regardless of idempotency; other retryable
             // statuses only when the verb is idempotent.
             const retryableStatus = retryableStatuses.has(response.status) &&
                 (retryAllowed || response.status === 429);
             if (attempt < maxRetries && retryableStatus) {
-                await sleep(retryAfterMs(response) ?? backoff(attempt, policy));
+                const delay = retryAfterMs(response) ?? backoff(attempt, policy);
+                let retryBody;
+                try {
+                    retryBody = await parseBody(response, req.method);
+                }
+                catch {
+                    retryBody = undefined;
+                }
+                emitResponseDebug(response, retryBody);
+                await sleep(delay);
                 continue;
             }
             let body;
@@ -382,7 +397,8 @@ export class HttpCore {
             catch {
                 body = undefined; // error responses keep their status even if the body read aborts
             }
-            const responseMeta = meta(response);
+            emitResponseDebug(response, body);
+            const responseMeta = meta(response, body);
             const Ctor = req.errors?.[String(response.status)] ??
                 req.errors?.[String(Math.floor(response.status / 100)) + "XX"] ??
                 req.errors?.["default"];
@@ -398,8 +414,9 @@ export class HttpCore {
         return { ok: false, error };
     }
     async send(req, timeoutMs, attempt, autoIdempotencyKey) {
+        const selected = req.security && this.config.credentials ? selectSecurity(req.security, this.config.credentials) : {};
         const headers = {};
-        for (const [k, v] of Object.entries(this.config.headers)) {
+        for (const [k, v] of Object.entries({ ...this.config.headers, ...selected.headers })) {
             headers[k] = await resolveAuthValue(v);
         }
         if (req.idempotencyKey && autoIdempotencyKey) {
@@ -416,31 +433,19 @@ export class HttpCore {
         }
         const context = {
             method: req.method,
-            url: await this.buildUrl(req),
+            url: await this.buildUrl(req, selected.query),
             headers,
             attempt,
         };
         await this.config.onRequest?.(context);
-        // Streaming responses are exempt from the attempt timeout once headers
-        // arrive (an event stream may stay open far longer than timeoutMs);
-        // everything else keeps the timeout armed through the body read, so a
-        // stalled body aborts instead of hanging.
         const signals = [];
-        let clearStreamTimeout;
-        if (req.stream) {
-            const headersTimeout = new AbortController();
-            const timer = setTimeout(() => headersTimeout.abort(new DOMException("Timed out waiting for response headers", "TimeoutError")), timeoutMs);
-            timer.unref?.();
-            clearStreamTimeout = () => clearTimeout(timer);
-            signals.push(headersTimeout.signal);
-        }
-        else {
+        {
             signals.push(AbortSignal.timeout(timeoutMs));
         }
         if (req.options?.signal)
             signals.push(req.options.signal);
         try {
-            const signal = AbortSignal.any(signals);
+            const signal = composeSignals(signals);
             const response = this.manualRedirects
                 ? await this.followRedirects(context, body, signal)
                 : await this.config.fetch(context.url, {
@@ -453,7 +458,6 @@ export class HttpCore {
             return response;
         }
         finally {
-            clearStreamTimeout?.();
         }
     }
     /**
@@ -514,7 +518,7 @@ export class HttpCore {
             origin = target.origin;
         }
     }
-    async buildUrl(req) {
+    async buildUrl(req, authQuery) {
         const base = this.config.baseUrl.replace(/\/+$/, "");
         const url = new URL(base + req.path);
         for (const [k, v] of Object.entries(req.query ?? {})) {
@@ -529,7 +533,7 @@ export class HttpCore {
                 appendDeep(url.searchParams, k, v);
             }
         }
-        for (const [k, v] of Object.entries(this.config.query)) {
+        for (const [k, v] of Object.entries({ ...this.config.query, ...authQuery })) {
             url.searchParams.append(k, await resolveAuthValue(v));
         }
         return url.toString();
@@ -538,64 +542,6 @@ export class HttpCore {
 async function resolveAuthValue(value) {
     return typeof value === "function" ? await value() : value;
 }
-/** Parse a text/event-stream body into SseEvents, lazily. */
-async function* sseEvents(response) {
-    if (!response.body)
-        return;
-    const reader = response.body.getReader();
-    const decoder = new TextDecoder();
-    let buffer = "";
-    let dataLines = [];
-    let eventName;
-    let eventId;
-    const flush = () => {
-        if (dataLines.length === 0)
-            return undefined;
-        const event = { data: dataLines.join("\n") };
-        if (eventName !== undefined)
-            event.event = eventName;
-        if (eventId !== undefined)
-            event.id = eventId;
-        dataLines = [];
-        eventName = undefined;
-        return event;
-    };
-    try {
-        while (true) {
-            const { done, value } = await reader.read();
-            if (done)
-                break;
-            buffer += decoder.decode(value, { stream: true });
-            let newline;
-            while ((newline = buffer.indexOf("\n")) !== -1) {
-                const hasCr = newline > 0 && buffer[newline - 1] === "\r";
-                const line = buffer.slice(0, hasCr ? newline - 1 : newline);
-                buffer = buffer.slice(newline + 1);
-                if (line === "") {
-                    const event = flush();
-                    if (event)
-                        yield event;
-                }
-                else if (line.startsWith("data:")) {
-                    dataLines.push(line.slice(5).replace(/^ /, ""));
-                }
-                else if (line.startsWith("event:")) {
-                    eventName = line.slice(6).replace(/^ /, "");
-                }
-                else if (line.startsWith("id:")) {
-                    eventId = line.slice(3).replace(/^ /, "");
-                }
-                // comments (":") and "retry:" are intentionally ignored
-            }
-        }
-        const last = flush();
-        if (last)
-            yield last;
-    }
-    finally {
-        reader.releaseLock();
-    }
-}
 /** Default rendering for debug events (the boolean debug:true sink). */
 export function formatDebugEvent(name, event) {
     return name + " " + event.method + " " + event.path +
@@ -612,54 +558,6 @@ export function bearerAuth(token) {
     }
     return "Bearer " + token;
 }
-/**
- * OAuth2 client-credentials token source: fetches from the token URL,
- * caches until expiry (60s early refresh), and shares one in-flight
- * request across concurrent callers. Returned function plugs in as an
- * Authorization AuthValue, resolved before every attempt.
- */
-export function oauthClientCredentials(config) {
-    let token;
-    let expiresAt = 0;
-    let inflight;
-    const fetchImpl = config.fetchImpl ?? fetch;
-    async function fetchToken() {
-        const params = new URLSearchParams({ grant_type: "client_credentials" });
-        if (config.scopes !== undefined && config.scopes.length > 0) {
-            params.set("scope", config.scopes.join(" "));
-        }
-        for (const [key, value] of Object.entries(config.tokenParams ?? {})) {
-            params.set(key, value);
-        }
-        const headers = {
-            "Content-Type": "application/x-www-form-urlencoded",
-            Accept: "application/json",
-        };
-        if (config.authMethod === "basic") {
-            headers["Authorization"] = "Basic " + toBase64(config.clientId + ":" + config.clientSecret);
-        }
-        else {
-            params.set("client_id", config.clientId);
-            params.set("client_secret", config.clientSecret);
-        }
-        const response = await fetchImpl(config.tokenUrl, { method: "POST", headers, body: params.toString() });
-        const body = (await response.json().catch(() => null));
-        if (!response.ok || typeof body?.access_token !== "string") {
-            throw new TransportError("OAuth token request failed (HTTP " + response.status + (body?.error ? ": " + body.error : "") + ")", body);
-        }
-        token = body.access_token;
-        expiresAt = body.expires_in !== undefined
-            ? Date.now() + body.expires_in * 1000 - 60_000
-            : Number.MAX_SAFE_INTEGER;
-        return token;
-    }
-    return async () => {
-        if (token !== undefined && Date.now() < expiresAt)
-            return "Bearer " + token;
-        inflight ??= fetchToken().finally(() => { inflight = undefined; });
-        return "Bearer " + (await inflight);
-    };
-}
 /**
  * Bracket-style deep encoding shared by query strings and form bodies:
  * { created: { gte: 5 } } -> created[gte]=5, { items: [{ id: "x" }] } ->
@@ -686,37 +584,28 @@ function serializeBody(req) {
     switch (req.bodyKind ?? "json") {
         case "json":
             return { body: JSON.stringify(req.body), contentType: "application/json" };
-        case "form": {
-            const params = new URLSearchParams();
-            for (const [k, v] of Object.entries(req.body)) {
-                appendDeep(params, k, v);
-            }
-            // URLSearchParams sets its own content type with the charset suffix.
-            return { body: params };
-        }
-        case "multipart": {
-            const form = new FormData();
-            for (const [k, v] of Object.entries(req.body)) {
-                if (v === undefined || v === null)
-                    continue;
-                form.append(k, v instanceof Blob ? v : typeof v === "object" ? JSON.stringify(v) : String(v));
-            }
-            // Let fetch set the boundary header.
-            return { body: form };
-        }
-        case "text":
-            return { body: String(req.body), contentType: "text/plain" };
-        case "binary":
-            return { body: req.body };
     }
+    throw new Error("Unsupported request body kind: " + String(req.bodyKind));
 }
 async function parseBody(response, method) {
     if (method === "HEAD" || response.status === 204 || response.status === 205)
         return undefined;
-    const contentType = response.headers.get("content-type") ?? "";
+    const contentType = (response.headers.get("content-type") ?? "").toLowerCase();
+    const mediaType = contentType.split(";", 1)[0].trim();
+    const slash = mediaType.indexOf("/");
+    const subtype = slash === -1 ? "" : mediaType.slice(slash + 1);
     try {
-        if (contentType.includes("json"))
-            return await response.json();
+        if (subtype === "json" || subtype.endsWith("+json")) {
+            const body = await response.text();
+            if (body.length === 0)
+                return undefined;
+            try {
+                return JSON.parse(body);
+            }
+            catch (cause) {
+                throw new ResponseParseError(body, meta(response, body), cause);
+            }
+        }
         if (contentType.startsWith("text/"))
             return await response.text();
         if (response.body === null)
@@ -724,22 +613,55 @@ async function parseBody(response, method) {
         return await response.blob();
     }
     catch (cause) {
-        // A timed-out or aborted body read is a transport failure, not an
-        // empty body — surface it instead of faking success.
-        if (cause instanceof Error && (cause.name === "AbortError" || cause.name === "TimeoutError"))
+        if (cause instanceof ResponseParseError)
             throw cause;
-        return undefined;
+        // A timed-out, aborted, or prematurely terminated body is a transport
+        // failure, not an empty body — surface it instead of faking success.
+        throw cause;
     }
 }
-function meta(response) {
+function requestIdFromBody(body) {
+    if (!body || typeof body !== "object" || Array.isArray(body))
+        return undefined;
+    const value = body.request_id ?? body.requestId;
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function meta(response, body) {
     return {
         status: response.status,
         headers: response.headers,
-        requestId: response.headers.get("x-request-id") ??
+        ...(body !== undefined ? { rawBody: body } : {}),
+        requestId: requestIdFromBody(body) ??
             response.headers.get("request-id") ??
+            response.headers.get("x-request-id") ??
             undefined,
     };
 }
+/** AbortSignal.any reached Node in 18.17. Keep the package's Node 18 floor
+ * honest for earlier 18.x releases and for web runtimes without it. */
+function composeSignals(signals) {
+    const nativeAny = AbortSignal.any;
+    if (nativeAny)
+        return nativeAny.call(AbortSignal, signals);
+    const controller = new AbortController();
+    const listeners = new Map();
+    const abortFrom = (signal) => {
+        for (const [item, listener] of listeners)
+            item.removeEventListener("abort", listener);
+        listeners.clear();
+        controller.abort(signal.reason);
+    };
+    for (const signal of signals) {
+        if (signal.aborted) {
+            abortFrom(signal);
+            break;
+        }
+        const listener = () => abortFrom(signal);
+        listeners.set(signal, listener);
+        signal.addEventListener("abort", listener, { once: true });
+    }
+    return controller.signal;
+}
 function retryAfterMs(response) {
     const header = response.headers.get("retry-after");
     if (!header)

package/dist/core/pagination.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pagination.d.ts","sourceRoot":"","sources":["../../src/core/pagination.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,QAAQ,EACR,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,YAAY,EAClB,MAAM,WAAW,CAAC;AAEnB,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,QAAQ,GAAG,kBAAkB,GAAG,MAAM,GAAG,QAAQ,CAAC;IACzD,kEAAkE;IAClE,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,CACxB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC3B,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAE1C,qBAAa,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,OAAO;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAC/C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0B;IACjD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;gBAG9B,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,EAC7B,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,YAAY;IASxB,IAAI,KAAK,IAAI,IAAI,EAAE,CAGlB;IAED,WAAW,IAAI,OAAO;IAItB,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAmChD,iGAAiG;IAC3F,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;IAUlD,+DAA+D;IACxD,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC;IAQrE,OAAO,CAAC,aAAa;CAUtB;AAED;;;GAGG;AACH,qBAAa,WAAW,CAAC,IAAI,EAAE,CAAC,CAAE,YAAW,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,IAAI,CAAC;IACxG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAuC;gBACjD,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAIvD,IAAI,CAAC,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,KAAK,EAC/C,WAAW,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,EACnF,UAAU,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,KAAK,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,GAC9D,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IAIZ,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC;CAOtE;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,CAAC,EAC9B,IAAI,EAAE,QAAQ,EACd,GAAG,EAAE,WAAW,EAChB,MAAM,EAAE,UAAU,GACjB,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAyBtB"}
+{"version":3,"file":"pagination.d.ts","sourceRoot":"","sources":["../../src/core/pagination.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,QAAQ,EACR,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,YAAY,EAClB,MAAM,WAAW,CAAC;AAEnB,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,QAAQ,GAAG,kBAAkB,GAAG,MAAM,GAAG,QAAQ,CAAC;IACzD,kEAAkE;IAClE,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC,IAAI,CACxB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC3B,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAE1C,qBAAa,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,OAAO;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAC/C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0B;IACjD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;gBAG9B,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,EAC7B,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,YAAY;IASxB,IAAI,KAAK,IAAI,IAAI,EAAE,CAGlB;IAED,WAAW,IAAI,OAAO;IAItB,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAoBhD,iGAAiG;IAC3F,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;IAUlD,+DAA+D;IACxD,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC;IAQrE,OAAO,CAAC,aAAa;CAUtB;AAED;;;GAGG;AACH,qBAAa,WAAW,CAAC,IAAI,EAAE,CAAC,CAAE,YAAW,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,IAAI,CAAC;IACxG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAuC;gBACjD,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAIvD,IAAI,CAAC,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,KAAK,EAC/C,WAAW,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,EACnF,UAAU,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,KAAK,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,GAC9D,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;IAIZ,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC;CAOtE;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,CAAC,EAC9B,IAAI,EAAE,QAAQ,EACd,GAAG,EAAE,WAAW,EAChB,MAAM,EAAE,UAAU,GACjB,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAgBtB"}

package/dist/core/pagination.js

@@ -37,30 +37,12 @@ export class Page {
                 const next = getPath(this.body, config.nextCursorField);
                 if (next === undefined || next === null || next === "")
                     return null;
-                return { ...params, [config.cursorParam]: next };
-            }
-            case "cursorFromLastId": {
-                if (items.length === 0)
-                    return null;
-                const last = items[items.length - 1];
-                const id = last?.[config.idField ?? "id"];
-                if (id === undefined || id === null)
-                    return null;
-                return { ...params, [config.cursorParam]: id };
-            }
-            case "page": {
-                if (!this.looksLikeMore(items))
+                if (next === params[config.cursorParam])
                     return null;
-                const current = Number(params[config.pageParam] ?? 1);
-                return { ...params, [config.pageParam]: current + 1 };
-            }
-            case "offset": {
-                if (!this.looksLikeMore(items))
-                    return null;
-                const current = Number(params[config.offsetParam] ?? 0);
-                return { ...params, [config.offsetParam]: current + items.length };
+                return { ...params, [config.cursorParam]: next };
             }
         }
+        return null;
     }
     /** Fetch the next page, or null when this is the last one. Throws the typed error on failure. */
     async getNextPage() {
@@ -116,17 +98,9 @@ export class PagePromise {
     }
 }
 export function paginate(core, req, config) {
-    const isGraphql = req.graphqlField !== undefined;
+    const isGraphql = false;
     const fetchPage = async (params) => {
-        const nextReq = isGraphql
-            ? {
-                ...req,
-                body: {
-                    ...req.body,
-                    variables: { ...(req.body?.variables ?? {}), ...params },
-                },
-            }
-            : { ...req, query: params };
+        let nextReq = { ...req, query: params };
         const result = await core.request(nextReq);
         if (!result.ok)
             return result;
@@ -134,9 +108,7 @@ export function paginate(core, req, config) {
         return { ok: true, data: page, response: result.response };
     };
     const initial = {};
-    const seed = isGraphql
-        ? (req.body?.variables ?? {})
-        : (req.query ?? {});
+    let seed = req.query ?? {};
     for (const [k, v] of Object.entries(seed)) {
         if (v !== undefined)
             initial[k] = v;

package/dist/credential-storage.d.ts

@@ -0,0 +1,24 @@
+import { FileCredentialStore, type CredentialCodec } from "./oauth-session.js";
+export interface NativeCommandResult {
+    status: number | null;
+    stdout: string;
+    stderr: string;
+    error?: unknown;
+}
+export type NativeCommand = (executable: string, args: string[], input?: string) => NativeCommandResult;
+export interface CredentialKeyStore {
+    readonly name: string;
+    read(): Buffer | null;
+    write(key: Buffer): void;
+    /** Used only when explicitly removing this wrapping key, not ordinary logout. */
+    remove(): void;
+}
+/** A small wrapping key avoids OS item-size limits; session files are encrypted
+ * separately so refresh rotation can retain the atomic file/lock transaction. */
+export declare function nativeCredentialKeyStore(path: string, platform?: NodeJS.Platform, run?: NativeCommand, environmentName?: string): CredentialKeyStore;
+export declare function encryptedCredentialCodec(path: string, keyStore: CredentialKeyStore): CredentialCodec;
+/** OS protection is the default. Plaintext storage is an explicit, separate
+ * store for environments where the owner accepts that tradeoff. Never migrate
+ * or fall back silently when an OS service is unavailable. */
+export declare function createCredentialStore(directory: string, mode?: string, environmentName?: string): FileCredentialStore;
+//# sourceMappingURL=credential-storage.d.ts.map

package/dist/credential-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-storage.d.ts","sourceRoot":"","sources":["../src/credential-storage.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,mBAAmB,EAA0B,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAEvG,MAAM,WAAW,mBAAmB;IAAG,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE;AAC/G,MAAM,MAAM,aAAa,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,mBAAmB,CAAC;AACxG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,IAAI,IAAI,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,iFAAiF;IACjF,MAAM,IAAI,IAAI,CAAC;CAChB;AAkBD;iFACiF;AACjF,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAAE,GAAG,GAAE,aAA6B,EAAE,eAAe,SAAqB,GAAG,kBAAkB,CAsGjM;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,eAAe,CAkCpG;AAED;;8DAE8D;AAC9D,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,GAAE,MAAa,EAAE,eAAe,SAAqB,GAAG,mBAAmB,CAKvI"}