@typeship-ax/cli 0.8.0 → 0.10.0

package/dist/console-login-check.d.ts

@@ -0,0 +1,21 @@
+import { type ConsoleLoginCheck, type ConsoleLoginConfiguration } from "./console-login-contract.js";
+import { type OAuthLoginSession } from "./oauth-login.js";
+import { type CredentialSchemes, type NamedCredentials } from "./named-credentials.js";
+/** No traffic to Typeship occurs without the explicit --console-check action.
+ * Only the credentials selected for the identity read leave this process;
+ * refresh tokens and other stored logins are never sent to the Console. */
+export declare function checkConsoleBrowserLogin(input: {
+    file: string;
+    configuration: ConsoleLoginConfiguration;
+    schemes: CredentialSchemes;
+    credentials: NamedCredentials;
+    login(timeoutMs: number): Promise<OAuthLoginSession>;
+    verify(credentials: NamedCredentials, expectations: ConsoleLoginCheck["expectations"]): Promise<void>;
+    progress(message: string): void;
+}): Promise<{
+    ok: true;
+    method: "oauth_browser";
+    console_verified: true;
+    revoked: boolean | null;
+}>;
+//# sourceMappingURL=console-login-check.d.ts.map

package/dist/console-login-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"console-login-check.d.ts","sourceRoot":"","sources":["../src/console-login-check.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgE,KAAK,iBAAiB,EAAE,KAAK,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACnK,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAyB,KAAK,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAuB9G;;2EAE2E;AAC3E,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,yBAAyB,CAAC;IACzC,OAAO,EAAE,iBAAiB,CAAC;IAC3B,WAAW,EAAE,gBAAgB,CAAC;IAC9B,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACrD,MAAM,CAAC,WAAW,EAAE,gBAAgB,EAAE,YAAY,EAAE,iBAAiB,CAAC,cAAc,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtG,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,eAAe,CAAC;IAAC,gBAAgB,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAA;CAAE,CAAC,CAiDlG"}

package/dist/console-login-check.js

@@ -0,0 +1,107 @@
+import { openSync, readSync, closeSync, fstatSync, constants } from "node:fs";
+import { oauthJsonRequest } from "./oauth-request.js";
+import { sameConsoleLoginConfiguration, matchesConsoleBrowserEvidence } from "./console-login-contract.js";
+import { parseNamedCredentials } from "./named-credentials.js";
+function readCheck(path) {
+    let fd;
+    try {
+        fd = openSync(path, constants.O_RDONLY | constants.O_NONBLOCK);
+        if (!fstatSync(fd).isFile())
+            throw new Error();
+        const buffer = Buffer.alloc(65_537);
+        let size = 0;
+        while (size < buffer.length) {
+            const n = readSync(fd, buffer, size, buffer.length - size, null);
+            if (!n)
+                break;
+            size += n;
+        }
+        if (size > 65_536)
+            throw new Error();
+        const value = JSON.parse(buffer.subarray(0, size).toString("utf8"));
+        if (value.version !== 1 || typeof value.ticket !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(value.ticket) || !value.configuration || !Array.isArray(value.expectations) || !value.expectations.length || value.expectations.length > 3)
+            throw new Error();
+        const endpoint = new URL(value.endpoint);
+        const development = endpoint.protocol === "http:" && ["127.0.0.1", "[::1]"].includes(endpoint.hostname);
+        if (!(endpoint.origin === "https://typeship.dev" || development) || endpoint.pathname !== "/api/authentication/browser" || endpoint.username || endpoint.password || endpoint.search || endpoint.hash)
+            throw new Error();
+        const remaining = Date.parse(value.expiresAt) - Date.now();
+        if (!Number.isFinite(remaining) || remaining <= 0 || remaining > 600_000)
+            throw new Error();
+        return value;
+    }
+    catch {
+        throw new Error("Download a new login check from your Typeship Console and pass its JSON file to --console-check. Checks expire after ten minutes.");
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+}
+/** No traffic to Typeship occurs without the explicit --console-check action.
+ * Only the credentials selected for the identity read leave this process;
+ * refresh tokens and other stored logins are never sent to the Console. */
+export async function checkConsoleBrowserLogin(input) {
+    const check = readCheck(input.file);
+    if (!sameConsoleLoginConfiguration(input.configuration, check.configuration))
+        throw new Error("This CLI's authentication settings do not match the saved Target. Regenerate the CLI, select the matching environment, and download a new check.");
+    const send = async (body, timeoutMs = 30_000) => {
+        const response = await oauthJsonRequest(check.endpoint, { method: "POST", headers: { "Content-Type": "application/json", Accept: "application/json" }, body: JSON.stringify({ ticket: check.ticket, ...body }) }, timeoutMs);
+        if (response.status === 422)
+            throw new Error("Typeship could not verify this login. Check the expected identity, API permissions and saved Target settings, then download a new check.");
+        if (response.status !== 200 || response.data?.ok !== true)
+            throw new Error("The Console check expired, was already used, changed, or could not be completed. Download a new check and try again.");
+        return response.data;
+    };
+    await send({ action: "inspect" });
+    let revoked = null;
+    try {
+        const supplied = parseNamedCredentials(input.credentials, input.schemes);
+        // Only a complete alternative that uses the fresh browser token proves
+        // browser access. An unrelated key-only alternative is not sufficient.
+        const requirement = input.configuration.requirements.find((entry) => {
+            const names = Object.keys(entry);
+            if (!names.some((name) => input.schemes[name]?.kind === "bearer") || !names.every((name) => input.schemes[name]?.kind === "bearer" || supplied[name] !== undefined))
+                return false;
+            const selected = input.configuration.requirements.find((candidate) => Object.keys(candidate).every((name) => names.includes(name)));
+            return selected && Object.keys(selected).some((name) => input.schemes[name]?.kind === "bearer");
+        });
+        if (!requirement)
+            throw new Error("Supply the additional named credentials required by the identity read with --credentials @file or environment variables.");
+        input.progress("This check runs a temporary browser login. Typeship will receive only the access token and any additional credentials required for the identity read; refresh tokens stay on this computer.");
+        const session = await input.login(Math.max(1, Date.parse(check.expiresAt) - Date.now()));
+        try {
+            const evidence = { method: "oauth_browser", issuer: session.issuer, clientId: session.clientId, redirectUri: session.redirectUri };
+            if (!matchesConsoleBrowserEvidence(input.configuration, evidence))
+                throw new Error("The browser login did not use the Target's client registration and native callback.");
+            const credentials = Object.fromEntries(Object.keys(requirement).map((name) => [name, input.schemes[name].kind === "bearer" ? session.accessToken : supplied[name]]));
+            await input.verify(credentials, check.expectations);
+            await send({ action: "complete", configuration: input.configuration, evidence, credentials, expectations: check.expectations });
+        }
+        finally {
+            // Verification sessions never replace the customer's saved login.
+            // Revoke the temporary grant when the provider advertises an endpoint.
+            if (session.revocationUrl) {
+                try {
+                    const response = await fetch(session.revocationUrl, { method: "POST", redirect: "error", credentials: "omit", signal: AbortSignal.timeout(10_000), headers: { "Content-Type": "application/x-www-form-urlencoded" }, body: new URLSearchParams({ token: session.refreshToken ?? session.accessToken, token_type_hint: session.refreshToken ? "refresh_token" : "access_token", client_id: session.clientId }) });
+                    void response.body?.cancel().catch(() => { });
+                    revoked = response.status === 200;
+                }
+                catch {
+                    revoked = false;
+                }
+            }
+        }
+    }
+    catch (error) {
+        // Report only that the attempt ended. Never send provider errors, identity
+        // values or credentials, and never replace the original local error. A
+        // consumed check rejects this report, preserving any completed API proof.
+        try {
+            await send({ action: "fail" }, 5_000);
+        }
+        catch { /* Best effort; the Console can still expire the check. */ }
+        throw error;
+    }
+    return { ok: true, method: "oauth_browser", console_verified: true, revoked };
+}

package/dist/console-login-contract.d.ts

@@ -0,0 +1,45 @@
+export interface ConsoleLoginConfiguration {
+    baseUrl: string;
+    environment: string | null;
+    operation: string;
+    request: {
+        method: string;
+        path: string;
+        graphqlField: string | null;
+        graphqlQuery: string | null;
+    };
+    requirements: Record<string, string[]>[];
+    issuer: string;
+    clientId: string;
+    discoveryUrl: string | null;
+    authorizationUrl: string | null;
+    tokenUrl: string | null;
+    redirectUri: string;
+    scopes: string[];
+    audience: string | null;
+    resource: string | null;
+}
+export interface ConsoleIdentityExpectation {
+    kind: "account" | "organization" | "user";
+    pointer: string;
+    expected: string | number;
+}
+export interface ConsoleLoginCheck {
+    version: 1;
+    endpoint: string;
+    ticket: string;
+    expiresAt: string;
+    configuration: ConsoleLoginConfiguration;
+    expectations: ConsoleIdentityExpectation[];
+}
+export interface ConsoleBrowserEvidence {
+    method: "oauth_browser";
+    issuer: string;
+    clientId: string;
+    redirectUri: string;
+}
+/** Compare the generated product's own settings with the reviewed check.
+ * The downloaded file never supplies the CLI's OAuth or API destination. */
+export declare function sameConsoleLoginConfiguration(left: ConsoleLoginConfiguration, right: ConsoleLoginConfiguration): boolean;
+export declare function matchesConsoleBrowserEvidence(config: ConsoleLoginConfiguration, evidence: ConsoleBrowserEvidence): boolean;
+//# sourceMappingURL=console-login-contract.d.ts.map

package/dist/console-login-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"console-login-contract.d.ts","sourceRoot":"","sources":["../src/console-login-contract.ts"],"names":[],"mappings":"AACA,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACpG,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AACD,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,SAAS,GAAG,cAAc,GAAG,MAAM,CAAC;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC;CAC3B;AACD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,yBAAyB,CAAC;IACzC,YAAY,EAAE,0BAA0B,EAAE,CAAC;CAC5C;AACD,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,eAAe,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAQD;4EAC4E;AAC5E,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAOxH;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,yBAAyB,EAAE,QAAQ,EAAE,sBAAsB,GAAG,OAAO,CAU1H"}

package/dist/console-login-contract.js

@@ -0,0 +1,40 @@
+function canonical(value) {
+    if (Array.isArray(value))
+        return "[" + value.map(canonical).join(",") + "]";
+    if (value && typeof value === "object")
+        return "{" + Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, item]) => JSON.stringify(key) + ":" + canonical(item)).join(",") + "}";
+    return JSON.stringify(value) ?? "null";
+}
+/** Compare the generated product's own settings with the reviewed check.
+ * The downloaded file never supplies the CLI's OAuth or API destination. */
+export function sameConsoleLoginConfiguration(left, right) {
+    const normalize = (value) => ({ ...value,
+        baseUrl: new URL(value.baseUrl).href,
+        scopes: [...new Set(value.scopes)].sort(),
+        requirements: value.requirements.map((entry) => Object.fromEntries(Object.entries(entry).map(([key, scopes]) => [key, [...new Set(scopes)].sort()]))),
+    });
+    try {
+        return canonical(normalize(left)) === canonical(normalize(right));
+    }
+    catch {
+        return false;
+    }
+}
+export function matchesConsoleBrowserEvidence(config, evidence) {
+    try {
+        if (evidence.method !== "oauth_browser" || evidence.issuer !== config.issuer || evidence.clientId !== config.clientId)
+            return false;
+        const configured = new URL(config.redirectUri), actual = new URL(evidence.redirectUri);
+        if (configured.protocol !== "http:" || !["127.0.0.1", "[::1]"].includes(configured.hostname) || configured.username || configured.password || configured.search || configured.hash)
+            return false;
+        if (configured.port && configured.port !== actual.port)
+            return false;
+        if (!actual.port)
+            return false;
+        configured.port = actual.port;
+        return configured.href === actual.href;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/core/http.d.ts

@@ -64,6 +64,14 @@ export declare class ApiError<S extends number = number, B = unknown> extends Er
 export declare class UnexpectedApiError extends ApiError<number, unknown> {
     constructor(status: number, body: unknown, response: ResponseMeta);
 }
+/** A successful response declared JSON but carried a body that could not be parsed. */
+export declare class ResponseParseError extends Error {
+    readonly status: number;
+    readonly body: string;
+    readonly response: ResponseMeta;
+    readonly cause?: unknown;
+    constructor(body: string, response: ResponseMeta, cause?: unknown);
+}
 export interface Violation {
     path: string;
     message: string;
@@ -82,13 +90,14 @@ export declare class ValidationError extends Error {
  * are ignored: validation can miss drift but never false-alarms.
  */
 export declare function validateAgainstSchema(value: unknown, schema: unknown, path: string, out: Violation[], defs?: Record<string, unknown>): void;
-/** The request never produced an HTTP response (network failure, timeout, abort). */
+/** The request failed before a complete HTTP response arrived (network failure, timeout, abort, or truncated body). */
 export declare class TransportError extends Error {
     readonly cause?: unknown;
     constructor(message: string, cause?: unknown);
 }
 type ErrorCtor = new (body: any, response: ResponseMeta) => ApiError<number, unknown>;
 export interface CoreRequest {
+    security?: Record<string, string[]>[];
     method: string;
     path: string;
     query?: Record<string, unknown>;
@@ -119,7 +128,13 @@ export interface RetryPolicy {
     /** Also retry non-idempotent methods (POST/PATCH). */
     retryNonIdempotent?: boolean;
 }
+export interface SecurityCredential {
+    headers?: Record<string, AuthValue>;
+    query?: Record<string, AuthValue>;
+}
 export interface CoreConfig {
+    /** Named credentials are selected using each operation's requirements. */
+    credentials?: Record<string, SecurityCredential>;
     baseUrl: string;
     headers: Record<string, AuthValue>;
     /** Auth carried as query parameters (apiKey-in-query schemes). */
@@ -177,7 +192,7 @@ export interface DebugEvent {
     /** 1-based; >1 means this was a retry */
     attempt: number;
     requestId?: string;
-    /** transport failure message, when there was no response */
+    /** transport failure message, when the request failed before a complete response */
     error?: string;
 }
 export declare class HttpCore {

package/dist/core/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/core/http.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,mCAAmC;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB;;iCAE6B;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;qCACiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;AAElE;8CAC8C;AAC9C,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;CACjB;AAGD;;;;GAIG;AACH,MAAM,MAAM,SAAS,CAAC,CAAC,EAAE,CAAC,IACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,CAAC,CAAC;IAAC,QAAQ,EAAE,YAAY,CAAA;CAAE,GAC7C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,CAAC,CAAC;IAAC,QAAQ,CAAC,EAAE,YAAY,CAAA;CAAE,CAAC;AAErD,0EAA0E;AAC1E,wBAAgB,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAIvD;AAED,gDAAgD;AAChD,qBAAa,QAAQ,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,OAAO,CAAE,SAAQ,KAAK;IACzE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACnB,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACjB,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;gBAEpB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,YAAY;CAOxE;AAED,kDAAkD;AAClD,qBAAa,kBAAmB,SAAQ,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;gBACnD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY;CAGlE;AAOD,MAAM,WAAW,SAAS;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAE5D;;0CAE0C;AAC1C,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,UAAU,CAAC;IAC3C,QAAQ,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;gBACrB,SAAS,EAAE,SAAS,GAAG,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE;CAQvE;AAeD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CA+E3I;AAqBD,qFAAqF;AACrF,qBAAa,cAAe,SAAQ,KAAK;IACvC,SAAkB,KAAK,CAAC,EAAE,OAAO,CAAC;gBAEtB,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAK7C;AAED,KAAK,SAAS,GAAG,KAAK,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,KAAK,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEtF,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,GAAG,QAAQ,CAAC;IAC7D,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACnC,qDAAqD;IACrD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;iDAC6C;IAC7C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;sEACkE;IAClE,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B;AAED,kFAAkF;AAClF,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACnC,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjC,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D;qDACiD;IACjD,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnF;;6BAEyB;IACzB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9F;sDACkD;IAClD,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACpC;;yCAEqC;IACrC,QAAQ,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,CAAC;IAC7E,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,GAAG,CAAC,EAAE,OAAO,CAAC;QAAC,GAAG,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC3D,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,yEAAyE;IACzE,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC;;;yBAGqB;IACrB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,gEAAgE;AAChE,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA0BD,qBAAa,QAAQ;IACnB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,6DAA6D;IAC7D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAW;IAC5C;iDAC6C;IAC7C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAU;gBAG9B,MAAM,EAAE,UAAU;IAa9B,kEAAkE;IAClE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI5B,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAqJjD,IAAI;IAmDlB;;;;;;;;;;;;OAYG;YACW,eAAe;YA+Cf,QAAQ;CAiBvB;AAOD,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,MAAM,CAOxE;AAED,+EAA+E;AAC/E,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,CAKtD;AA+GD,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAI9C"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/core/http.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,mCAAmC;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB;;iCAE6B;IAC7B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;qCACiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;AAElE;8CAC8C;AAC9C,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;CACjB;AAGD;;;;GAIG;AACH,MAAM,MAAM,SAAS,CAAC,CAAC,EAAE,CAAC,IACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,CAAC,CAAC;IAAC,QAAQ,EAAE,YAAY,CAAA;CAAE,GAC7C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,CAAC,CAAC;IAAC,QAAQ,CAAC,EAAE,YAAY,CAAA;CAAE,CAAC;AAErD,0EAA0E;AAC1E,wBAAgB,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAIvD;AAED,gDAAgD;AAChD,qBAAa,QAAQ,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,OAAO,CAAE,SAAQ,KAAK;IACzE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACnB,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACjB,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;gBAEpB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,YAAY;CAOxE;AAED,kDAAkD;AAClD,qBAAa,kBAAmB,SAAQ,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;gBACnD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY;CAGlE;AAED,uFAAuF;AACvF,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,SAAkB,KAAK,CAAC,EAAE,OAAO,CAAC;gBAEtB,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,OAAO;CAQlE;AAOD,MAAM,WAAW,SAAS;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAE5D;;0CAE0C;AAC1C,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,UAAU,CAAC;IAC3C,QAAQ,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;gBACrB,SAAS,EAAE,SAAS,GAAG,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE;CAQvE;AAeD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CA+E3I;AAqBD,uHAAuH;AACvH,qBAAa,cAAe,SAAQ,KAAK;IACvC,SAAkB,KAAK,CAAC,EAAE,OAAO,CAAC;gBAEtB,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAK7C;AAED,KAAK,SAAS,GAAG,KAAK,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,KAAK,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEtF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,GAAG,QAAQ,CAAC;IAC7D,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACnC,qDAAqD;IACrD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;iDAC6C;IAC7C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;sEACkE;IAClE,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B;AAED,kFAAkF;AAClF,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;CACnC;AA2BD,MAAM,WAAW,UAAU;IACzB,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACnC,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjC,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D;qDACiD;IACjD,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnF;;6BAEyB;IACzB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9F;sDACkD;IAClD,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IACpC;;yCAEqC;IACrC,QAAQ,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,CAAC;IAC7E,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,GAAG,CAAC,EAAE,OAAO,CAAC;QAAC,GAAG,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC3D,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,yEAAyE;IACzE,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC;;;yBAGqB;IACrB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,gEAAgE;AAChE,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA0BD,qBAAa,QAAQ;IACnB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,6DAA6D;IAC7D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAW;IAC5C;iDAC6C;IAC7C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAU;gBAG9B,MAAM,EAAE,UAAU;IAa9B,kEAAkE;IAClE,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI5B,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YA4JjD,IAAI;IAoDlB;;;;;;;;;;;;OAYG;YACW,eAAe;YA+Cf,QAAQ;CAiBvB;AAOD,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,MAAM,CAOxE;AAED,+EAA+E;AAC/E,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,CAKtD;AA0HD,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAI9C"}

package/dist/core/http.js

@@ -29,6 +29,21 @@ export class UnexpectedApiError extends ApiError {
         super("Unexpected HTTP status " + status, status, body, response);
     }
 }
+/** A successful response declared JSON but carried a body that could not be parsed. */
+export class ResponseParseError extends Error {
+    status;
+    body;
+    response;
+    cause;
+    constructor(body, response, cause) {
+        super("HTTP " + response.status + " response body was not valid JSON");
+        this.name = "ResponseParseError";
+        this.status = response.status;
+        this.body = body;
+        this.response = response;
+        this.cause = cause;
+    }
+}
 /** Request or response data did not match the spec's schema (opt-in via the
  * client's validate option). Never thrown: returned as the error side of
  * ApiResult, like every other failure. */
@@ -174,7 +189,7 @@ function transportFailureMessage(method, url, cause) {
     }
     return method + " " + url + " failed: " + detail;
 }
-/** The request never produced an HTTP response (network failure, timeout, abort). */
+/** The request failed before a complete HTTP response arrived (network failure, timeout, abort, or truncated body). */
 export class TransportError extends Error {
     cause;
     constructor(message, cause) {
@@ -183,6 +198,33 @@ export class TransportError extends Error {
         this.cause = cause;
     }
 }
+/** Resolve one complete alternative in spec order. Missing or incompatible
+ * combinations contribute no partial credentials. Anonymous operations send
+ * no generated credentials; explicit headers/hooks remain application owned. */
+function selectSecurity(requirements, credentials) {
+    for (const requirement of requirements) {
+        const names = Object.keys(requirement);
+        if (!names.length || names.some((name) => !Object.hasOwn(credentials, name)))
+            continue;
+        const selected = { headers: Object.create(null), query: Object.create(null) };
+        const destinations = new Set();
+        let conflict = false;
+        for (const name of names) {
+            for (const location of ["headers", "query"]) {
+                for (const [wire, value] of Object.entries(credentials[name][location] ?? {})) {
+                    const destination = location + ":" + (location === "headers" ? wire.toLowerCase() : wire);
+                    if (destinations.has(destination))
+                        conflict = true;
+                    destinations.add(destination);
+                    selected[location][wire] = value;
+                }
+            }
+        }
+        if (!conflict)
+            return selected;
+    }
+    return {};
+}
 const RETRYABLE_STATUSES = new Set([408, 429, 500, 502, 503, 504]);
 /** Credential-bearing headers fetch itself drops when a redirect crosses to
  * another origin. A spec's own API-key headers join them below. */
@@ -232,8 +274,13 @@ export class HttpCore {
         const policy = { ...this.config.retry, ...req.retry };
         const maxRetries = req.options?.maxRetries ?? policy.maxRetries ?? this.config.maxRetries;
         const timeoutMs = req.options?.timeoutMs ?? this.config.timeoutMs;
-        const retryAllowed = req.idempotent === true || req.method === "GET" || policy.retryNonIdempotent === true;
-        const retryableStatuses = policy.statuses ? new Set(policy.statuses) : RETRYABLE_STATUSES;
+        const retryAllowed = req.idempotent === true ||
+            req.method === "GET" ||
+            req.idempotencyKey !== undefined ||
+            policy.retryNonIdempotent === true;
+        const retryableStatuses = policy.statuses
+            ? new Set(policy.statuses)
+            : RETRYABLE_STATUSES;
         // One key per logical call, reused on every retry — that's the point
         // of idempotency keys.
         const autoIdempotencyKey = req.idempotencyKey !== undefined &&
@@ -299,10 +346,11 @@ export class HttpCore {
                     data = (await parseBody(response, req.method));
                 }
                 catch (cause) {
-                    emitResponseDebug(response);
-                    const error = new TransportError("The response body read was aborted before completing", cause);
+                    const parseError = cause instanceof ResponseParseError ? cause : undefined;
+                    emitResponseDebug(response, parseError?.body);
+                    const error = (parseError ?? new TransportError("The response body read failed before completing", cause));
                     await this.config.onError?.(error, { method: req.method, path: req.path });
-                    return { ok: false, error, response: meta(response) };
+                    return { ok: false, error, response: parseError?.response ?? meta(response) };
                 }
                 emitResponseDebug(response, data);
                 const responseMeta = meta(response, data);
@@ -366,8 +414,9 @@ export class HttpCore {
         return { ok: false, error };
     }
     async send(req, timeoutMs, attempt, autoIdempotencyKey) {
+        const selected = req.security && this.config.credentials ? selectSecurity(req.security, this.config.credentials) : {};
         const headers = {};
-        for (const [k, v] of Object.entries(this.config.headers)) {
+        for (const [k, v] of Object.entries({ ...this.config.headers, ...selected.headers })) {
             headers[k] = await resolveAuthValue(v);
         }
         if (req.idempotencyKey && autoIdempotencyKey) {
@@ -384,7 +433,7 @@ export class HttpCore {
         }
         const context = {
             method: req.method,
-            url: await this.buildUrl(req),
+            url: await this.buildUrl(req, selected.query),
             headers,
             attempt,
         };
@@ -469,7 +518,7 @@ export class HttpCore {
             origin = target.origin;
         }
     }
-    async buildUrl(req) {
+    async buildUrl(req, authQuery) {
         const base = this.config.baseUrl.replace(/\/+$/, "");
         const url = new URL(base + req.path);
         for (const [k, v] of Object.entries(req.query ?? {})) {
@@ -484,7 +533,7 @@ export class HttpCore {
                 appendDeep(url.searchParams, k, v);
             }
         }
-        for (const [k, v] of Object.entries(this.config.query)) {
+        for (const [k, v] of Object.entries({ ...this.config.query, ...authQuery })) {
             url.searchParams.append(k, await resolveAuthValue(v));
         }
         return url.toString();
@@ -541,10 +590,22 @@ function serializeBody(req) {
 async function parseBody(response, method) {
     if (method === "HEAD" || response.status === 204 || response.status === 205)
         return undefined;
-    const contentType = response.headers.get("content-type") ?? "";
+    const contentType = (response.headers.get("content-type") ?? "").toLowerCase();
+    const mediaType = contentType.split(";", 1)[0].trim();
+    const slash = mediaType.indexOf("/");
+    const subtype = slash === -1 ? "" : mediaType.slice(slash + 1);
     try {
-        if (contentType.includes("json"))
-            return await response.json();
+        if (subtype === "json" || subtype.endsWith("+json")) {
+            const body = await response.text();
+            if (body.length === 0)
+                return undefined;
+            try {
+                return JSON.parse(body);
+            }
+            catch (cause) {
+                throw new ResponseParseError(body, meta(response, body), cause);
+            }
+        }
         if (contentType.startsWith("text/"))
             return await response.text();
         if (response.body === null)
@@ -552,11 +613,11 @@ async function parseBody(response, method) {
         return await response.blob();
     }
     catch (cause) {
-        // A timed-out or aborted body read is a transport failure, not an
-        // empty body — surface it instead of faking success.
-        if (cause instanceof Error && (cause.name === "AbortError" || cause.name === "TimeoutError"))
+        if (cause instanceof ResponseParseError)
             throw cause;
-        return undefined;
+        // A timed-out, aborted, or prematurely terminated body is a transport
+        // failure, not an empty body — surface it instead of faking success.
+        throw cause;
     }
 }
 function requestIdFromBody(body) {

package/dist/credential-storage.d.ts

@@ -0,0 +1,24 @@
+import { FileCredentialStore, type CredentialCodec } from "./oauth-session.js";
+export interface NativeCommandResult {
+    status: number | null;
+    stdout: string;
+    stderr: string;
+    error?: unknown;
+}
+export type NativeCommand = (executable: string, args: string[], input?: string) => NativeCommandResult;
+export interface CredentialKeyStore {
+    readonly name: string;
+    read(): Buffer | null;
+    write(key: Buffer): void;
+    /** Used only when explicitly removing this wrapping key, not ordinary logout. */
+    remove(): void;
+}
+/** A small wrapping key avoids OS item-size limits; session files are encrypted
+ * separately so refresh rotation can retain the atomic file/lock transaction. */
+export declare function nativeCredentialKeyStore(path: string, platform?: NodeJS.Platform, run?: NativeCommand, environmentName?: string): CredentialKeyStore;
+export declare function encryptedCredentialCodec(path: string, keyStore: CredentialKeyStore): CredentialCodec;
+/** OS protection is the default. Plaintext storage is an explicit, separate
+ * store for environments where the owner accepts that tradeoff. Never migrate
+ * or fall back silently when an OS service is unavailable. */
+export declare function createCredentialStore(directory: string, mode?: string, environmentName?: string): FileCredentialStore;
+//# sourceMappingURL=credential-storage.d.ts.map

package/dist/credential-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-storage.d.ts","sourceRoot":"","sources":["../src/credential-storage.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,mBAAmB,EAA0B,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAEvG,MAAM,WAAW,mBAAmB;IAAG,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE;AAC/G,MAAM,MAAM,aAAa,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,mBAAmB,CAAC;AACxG,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,IAAI,IAAI,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,iFAAiF;IACjF,MAAM,IAAI,IAAI,CAAC;CAChB;AAkBD;iFACiF;AACjF,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAAE,GAAG,GAAE,aAA6B,EAAE,eAAe,SAAqB,GAAG,kBAAkB,CAsGjM;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,eAAe,CAkCpG;AAED;;8DAE8D;AAC9D,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,GAAE,MAAa,EAAE,eAAe,SAAqB,GAAG,mBAAmB,CAKvI"}