@typeship-ax/mcp 0.6.0 → 0.9.1

package/src/core/http.ts

@@ -17,7 +17,12 @@ export interface RequestOptions {
 export interface ResponseMeta {
   status: number;
   headers: Headers;
-  /** x-request-id / request-id header when the server sends one. */
+  /** Parsed wire body before it is narrowed to the generated response type.
+   * Use this escape hatch for additive fields or variants introduced after
+   * this generator edition. */
+  rawBody?: unknown;
+  /** Request identifier from the JSON response body, or from headers for
+   * raw and bodyless responses. */
   requestId?: string;
 }
 
@@ -37,15 +42,6 @@ export interface RequestContext {
   attempt: number;
 }
 
-/** One server-sent event from a text/event-stream response. */
-export interface SseEvent {
-  /** The `event:` field; undefined for unnamed events. */
-  event?: string;
-  /** The `id:` field, when the server sends one. */
-  id?: string;
-  /** Concatenated `data:` lines. Parse as JSON if your API sends JSON. */
-  data: string;
-}
 
 /**
  * Every SDK call returns a discriminated result instead of throwing.
@@ -85,97 +81,23 @@ export class UnexpectedApiError extends ApiError<number, unknown> {
   }
 }
 
-/** A 200 response whose GraphQL payload carried errors. */
-export class GraphQLRequestError extends Error {
-  /** The raw errors array from the GraphQL response. */
-  readonly errors: { message?: string; path?: unknown[]; extensions?: unknown }[];
+/** A successful response declared JSON but carried a body that could not be parsed. */
+export class ResponseParseError extends Error {
+  readonly status: number;
+  readonly body: string;
   readonly response: ResponseMeta;
+  override readonly cause?: unknown;
 
-  constructor(errors: unknown[], response: ResponseMeta) {
-    const first = (errors[0] as { message?: string } | undefined)?.message;
-    super(first ?? "GraphQL request returned errors");
-    this.name = "GraphQLRequestError";
-    this.errors = errors as GraphQLRequestError["errors"];
+  constructor(body: string, response: ResponseMeta, cause?: unknown) {
+    super("HTTP " + response.status + " response body was not valid JSON");
+    this.name = "ResponseParseError";
+    this.status = response.status;
+    this.body = body;
     this.response = response;
+    this.cause = cause;
   }
 }
 
-// ---------------------------------------------------------------------------
-// GraphQL selections — typed field picking over the schema's result types
-// ---------------------------------------------------------------------------
-
-type Primitive = string | number | boolean | bigint | symbol | null | undefined;
-type Unwrap<T> = NonNullable<T> extends readonly (infer U)[] ? Unwrap<U> : NonNullable<T>;
-type IsUnion<T, U = T> = T extends unknown ? ([U] extends [T] ? false : true) : never;
-type TypeNameOf<T> = T extends { __typename?: infer N } ? Extract<N, string> : never;
-type Prettify<T> = { [K in keyof T]: T[K] } & {};
-
-/**
- * A selection over a GraphQL result type `T`: `true` picks a leaf field, a
- * nested object picks inside an object field, and `on` picks per concrete
- * type when `T` is a union or interface (`{ on: { Transaction: { amount: true } } }`).
- * Keys are checked against the schema, so a typo is a compile error.
- */
-export type Selection<T> = Unwrap<T> extends Primitive ? never : SelectionObject<Unwrap<T>>;
-
-type FieldSelection<V> = Unwrap<V> extends Primitive ? true : SelectionObject<Unwrap<V>>;
-
-type SelectionObject<T> = {
-  [K in Extract<keyof T, string> as K extends "__typename" ? never : K]?: FieldSelection<T[K]>;
-} & { __typename?: true } & (IsUnion<T> extends true
-  ? { on?: { [N in TypeNameOf<T>]?: SelectionObject<Extract<T, { __typename?: N }>> } }
-  : { on?: never });
-
-/** The result type a {@link Selection} `S` produces from result type `T`:
- * exactly the fields picked, nullability and lists preserved, union members
- * narrowed by `__typename`. */
-export type Selected<T, S> = T extends readonly (infer U)[]
-  ? Selected<U, S>[]
-  : T extends Primitive
-    ? T
-    : S extends object
-      ? Prettify<SelectedMember<T, S>>
-      : never;
-
-type SelectedMember<T, S> = (S extends { on?: infer O }
-  ? O extends object
-    ? TypeNameOf<T> extends keyof O
-      ? PickSelected<T, NonNullable<O[TypeNameOf<T>]>>
-      : {}
-    : {}
-  : {}) &
-  PickSelected<T, S>;
-
-type PickSelected<T, S> = {
-  -readonly [K in keyof S as K extends "on" ? never : K extends keyof T ? (S[K] extends true | object ? K : never) : never]-?: K extends "__typename"
-    ? NonNullable<T[K & keyof T]>
-    : S[K] extends true
-      ? Exclude<T[K & keyof T], undefined>
-      : Selected<Exclude<T[K & keyof T], undefined>, S[K]>;
-};
-
-/** A selection object or a raw selection set (`"{ id name }"`). */
-export type SelectionInput = string | Record<string, unknown>;
-
-/** Serialize a selection object to a GraphQL selection set. Strings pass
- * through untouched. */
-export function selectionToString(selection: SelectionInput): string {
-  if (typeof selection === "string") return selection;
-  const parts: string[] = [];
-  for (const [key, value] of Object.entries(selection)) {
-    if (!value) continue;
-    if (key === "on" && typeof value === "object") {
-      for (const [typeName, sub] of Object.entries(value as Record<string, unknown>)) {
-        if (sub && typeof sub === "object") parts.push("... on " + typeName + " " + selectionToString(sub as Record<string, unknown>));
-      }
-    } else if (value === true) {
-      parts.push(key);
-    } else if (typeof value === "object") {
-      parts.push(key + " " + selectionToString(value as Record<string, unknown>));
-    }
-  }
-  return "{ " + (parts.length > 0 ? parts.join(" ") : "__typename") + " }";
-}
 
 // ---------------------------------------------------------------------------
 // Optional runtime validation — zero-dependency, schema table in schemas.ts
@@ -317,7 +239,7 @@ function transportFailureMessage(method: string, url: string, cause: unknown): s
   return method + " " + url + " failed: " + detail;
 }
 
-/** The request never produced an HTTP response (network failure, timeout, abort). */
+/** The request failed before a complete HTTP response arrived (network failure, timeout, abort, or truncated body). */
 export class TransportError extends Error {
   override readonly cause?: unknown;
 
@@ -331,6 +253,7 @@ export class TransportError extends Error {
 type ErrorCtor = new (body: any, response: ResponseMeta) => ApiError<number, unknown>;
 
 export interface CoreRequest {
+  security?: Record<string, string[]>[];
   method: string;
   path: string;
   query?: Record<string, unknown>;
@@ -341,14 +264,9 @@ export interface CoreRequest {
   errors?: Record<string, ErrorCtor>;
   /** Idempotent requests are retried automatically. */
   idempotent?: boolean;
-  /** Success body is text/event-stream: yield SseEvents instead of parsing. */
-  stream?: boolean;
   /** Header name auto-filled with one UUID per call (stable across retries)
    * when the caller doesn't supply a value. */
   idempotencyKey?: string;
-  /** GraphQL: unwrap body.data[field] and turn body.errors into a
-   * GraphQLRequestError. */
-  graphqlField?: string;
   /** Key into the schemas table for optional runtime validation. */
   schemaKey?: string;
   /** Operation-level retry policy (x-typeship-retries), merged over the
@@ -368,7 +286,39 @@ export interface RetryPolicy {
   retryNonIdempotent?: boolean;
 }
 
+export interface SecurityCredential {
+  headers?: Record<string, AuthValue>;
+  query?: Record<string, AuthValue>;
+}
+
+/** Resolve one complete alternative in spec order. Missing or incompatible
+ * combinations contribute no partial credentials. Anonymous operations send
+ * no generated credentials; explicit headers/hooks remain application owned. */
+function selectSecurity(requirements: Record<string, string[]>[], credentials: Record<string, SecurityCredential>): SecurityCredential {
+  for (const requirement of requirements) {
+    const names = Object.keys(requirement);
+    if (!names.length || names.some((name) => !Object.hasOwn(credentials, name))) continue;
+    const selected: SecurityCredential = { headers: Object.create(null), query: Object.create(null) };
+    const destinations = new Set<string>();
+    let conflict = false;
+    for (const name of names) {
+      for (const location of ["headers", "query"] as const) {
+        for (const [wire, value] of Object.entries(credentials[name]![location] ?? {})) {
+          const destination = location + ":" + (location === "headers" ? wire.toLowerCase() : wire);
+          if (destinations.has(destination)) conflict = true;
+          destinations.add(destination);
+          selected[location]![wire] = value;
+        }
+      }
+    }
+    if (!conflict) return selected;
+  }
+  return {};
+}
+
 export interface CoreConfig {
+  /** Named credentials are selected using each operation's requirements. */
+  credentials?: Record<string, SecurityCredential>;
   baseUrl: string;
   headers: Record<string, AuthValue>;
   /** Auth carried as query parameters (apiKey-in-query schemes). */
@@ -417,7 +367,7 @@ export interface DebugEvent {
   /** 1-based; >1 means this was a retry */
   attempt: number;
   requestId?: string;
-  /** transport failure message, when there was no response */
+  /** transport failure message, when the request failed before a complete response */
   error?: string;
 }
 
@@ -476,8 +426,14 @@ export class HttpCore {
     const policy: RetryPolicy = { ...this.config.retry, ...req.retry };
     const maxRetries = req.options?.maxRetries ?? policy.maxRetries ?? this.config.maxRetries;
     const timeoutMs = req.options?.timeoutMs ?? this.config.timeoutMs;
-    const retryAllowed = req.idempotent === true || req.method === "GET" || policy.retryNonIdempotent === true;
-    const retryableStatuses = policy.statuses ? new Set(policy.statuses) : RETRYABLE_STATUSES;
+    const retryAllowed =
+      req.idempotent === true ||
+      req.method === "GET" ||
+      req.idempotencyKey !== undefined ||
+      policy.retryNonIdempotent === true;
+    const retryableStatuses = policy.statuses
+      ? new Set(policy.statuses)
+      : RETRYABLE_STATUSES;
 
     // One key per logical call, reused on every retry — that's the point
     // of idempotency keys.
@@ -509,16 +465,20 @@ export class HttpCore {
     for (let attempt = 0; attempt <= maxRetries; attempt++) {
       let response: Response;
       const attemptStarted = Date.now();
+      const emitResponseDebug = (value: Response, body?: unknown) => this.config.debug?.({
+        method: req.method,
+        path: req.path,
+        status: value.status,
+        durationMs: Date.now() - attemptStarted,
+        attempt: attempt + 1,
+        requestId:
+          requestIdFromBody(body) ??
+          value.headers.get("request-id") ??
+          value.headers.get("x-request-id") ??
+          undefined,
+      });
       try {
         response = await this.send(req, timeoutMs, attempt, autoIdempotencyKey);
-        this.config.debug?.({
-          method: req.method,
-          path: req.path,
-          status: response.status,
-          durationMs: Date.now() - attemptStarted,
-          attempt: attempt + 1,
-          requestId: response.headers.get("x-request-id") ?? response.headers.get("request-id") ?? undefined,
-        });
       } catch (cause) {
         lastError = cause;
         this.config.debug?.({
@@ -541,23 +501,26 @@ export class HttpCore {
       }
 
       if (response.ok) {
-        if (req.stream) {
-          return { ok: true, data: sseEvents(response) as T, response: meta(response) };
-        }
         let data: T;
         try {
           data = (await parseBody(response, req.method)) as T;
         } catch (cause) {
-          const error = new TransportError(
-            "The response body read was aborted before completing",
+          const parseError = cause instanceof ResponseParseError ? cause : undefined;
+          emitResponseDebug(response, parseError?.body);
+          const error = (parseError ?? new TransportError(
+            "The response body read failed before completing",
             cause,
-          ) as unknown as E;
+          )) as unknown as E;
           await this.config.onError?.(error, { method: req.method, path: req.path });
-          return { ok: false, error, response: meta(response) };
+          return { ok: false, error, response: parseError?.response ?? meta(response) };
         }
-        if (opSchemas?.res && this.config.validate!.responses && data !== undefined) {
+        emitResponseDebug(response, data);
+        const responseMeta = meta(response, data);
+        let responseData: unknown = data;
+        let shouldValidateResponse = responseData !== undefined;
+        if (opSchemas?.res && this.config.validate!.responses && shouldValidateResponse) {
           const violations: Violation[] = [];
-          validateAgainstSchema(data, opSchemas.res, "response", violations, this.config.schemaDefs);
+          validateAgainstSchema(responseData, opSchemas.res, "response", violations, this.config.schemaDefs);
           if (violations.length > 0) {
             const validationError = new ValidationError("response", violations);
             if (this.config.validate!.mode === "warn") {
@@ -565,21 +528,11 @@ export class HttpCore {
             } else {
               const error = validationError as unknown as E;
               await this.config.onError?.(error, { method: req.method, path: req.path });
-              return { ok: false, error, response: meta(response) };
+              return { ok: false, error, response: responseMeta };
             }
           }
         }
-        if (req.graphqlField) {
-          const payload = data as { data?: Record<string, unknown>; errors?: unknown[] } | undefined;
-          const responseMeta = meta(response);
-          if (Array.isArray(payload?.errors) && payload.errors.length > 0) {
-            const gqlError = new GraphQLRequestError(payload.errors, responseMeta) as unknown as E;
-            await this.config.onError?.(gqlError, { method: req.method, path: req.path });
-            return { ok: false, error: gqlError, response: responseMeta };
-          }
-          return { ok: true, data: payload?.data?.[req.graphqlField] as T, response: responseMeta };
-        }
-        return { ok: true, data, response: meta(response) };
+        return { ok: true, data, response: responseMeta };
       }
 
       // 429 is safe to retry regardless of idempotency; other retryable
@@ -588,7 +541,15 @@ export class HttpCore {
         retryableStatuses.has(response.status) &&
         (retryAllowed || response.status === 429);
       if (attempt < maxRetries && retryableStatus) {
-        await sleep(retryAfterMs(response) ?? backoff(attempt, policy));
+        const delay = retryAfterMs(response) ?? backoff(attempt, policy);
+        let retryBody: unknown;
+        try {
+          retryBody = await parseBody(response, req.method);
+        } catch {
+          retryBody = undefined;
+        }
+        emitResponseDebug(response, retryBody);
+        await sleep(delay);
         continue;
       }
 
@@ -598,7 +559,8 @@ export class HttpCore {
       } catch {
         body = undefined; // error responses keep their status even if the body read aborts
       }
-      const responseMeta = meta(response);
+      emitResponseDebug(response, body);
+      const responseMeta = meta(response, body);
       const Ctor =
         req.errors?.[String(response.status)] ??
         req.errors?.[String(Math.floor(response.status / 100)) + "XX"] ??
@@ -622,8 +584,9 @@ export class HttpCore {
     attempt: number,
     autoIdempotencyKey?: string,
   ): Promise<Response> {
+    const selected = req.security && this.config.credentials ? selectSecurity(req.security, this.config.credentials) : {};
     const headers: Record<string, string> = {};
-    for (const [k, v] of Object.entries(this.config.headers)) {
+    for (const [k, v] of Object.entries({ ...this.config.headers, ...selected.headers })) {
       headers[k] = await resolveAuthValue(v);
     }
     if (req.idempotencyKey && autoIdempotencyKey) {
@@ -639,34 +602,20 @@ export class HttpCore {
 
     const context: RequestContext = {
       method: req.method,
-      url: await this.buildUrl(req),
+      url: await this.buildUrl(req, selected.query),
       headers,
       attempt,
     };
     await this.config.onRequest?.(context);
 
-    // Streaming responses are exempt from the attempt timeout once headers
-    // arrive (an event stream may stay open far longer than timeoutMs);
-    // everything else keeps the timeout armed through the body read, so a
-    // stalled body aborts instead of hanging.
     const signals: AbortSignal[] = [];
-    let clearStreamTimeout: (() => void) | undefined;
-    if (req.stream) {
-      const headersTimeout = new AbortController();
-      const timer = setTimeout(
-        () => headersTimeout.abort(new DOMException("Timed out waiting for response headers", "TimeoutError")),
-        timeoutMs,
-      );
-      (timer as { unref?: () => void }).unref?.();
-      clearStreamTimeout = () => clearTimeout(timer);
-      signals.push(headersTimeout.signal);
-    } else {
+    {
       signals.push(AbortSignal.timeout(timeoutMs));
     }
     if (req.options?.signal) signals.push(req.options.signal);
 
     try {
-      const signal = AbortSignal.any(signals);
+      const signal = composeSignals(signals);
       const response = this.manualRedirects
         ? await this.followRedirects(context, body, signal)
         : await this.config.fetch(context.url, {
@@ -678,7 +627,6 @@ export class HttpCore {
       await this.config.onResponse?.(response, context);
       return response;
     } finally {
-      clearStreamTimeout?.();
     }
   }
 
@@ -742,7 +690,7 @@ export class HttpCore {
     }
   }
 
-  private async buildUrl(req: CoreRequest): Promise<string> {
+  private async buildUrl(req: CoreRequest, authQuery?: Record<string, AuthValue>): Promise<string> {
     const base = this.config.baseUrl.replace(/\/+$/, "");
     const url = new URL(base + req.path);
     for (const [k, v] of Object.entries(req.query ?? {})) {
@@ -754,7 +702,7 @@ export class HttpCore {
         appendDeep(url.searchParams, k, v);
       }
     }
-    for (const [k, v] of Object.entries(this.config.query)) {
+    for (const [k, v] of Object.entries({ ...this.config.query, ...authQuery })) {
       url.searchParams.append(k, await resolveAuthValue(v));
     }
     return url.toString();
@@ -765,55 +713,6 @@ async function resolveAuthValue(value: AuthValue): Promise<string> {
   return typeof value === "function" ? await value() : value;
 }
 
-/** Parse a text/event-stream body into SseEvents, lazily. */
-async function* sseEvents(response: Response): AsyncGenerator<SseEvent, void, undefined> {
-  if (!response.body) return;
-  const reader = response.body.getReader();
-  const decoder = new TextDecoder();
-  let buffer = "";
-  let dataLines: string[] = [];
-  let eventName: string | undefined;
-  let eventId: string | undefined;
-
-  const flush = (): SseEvent | undefined => {
-    if (dataLines.length === 0) return undefined;
-    const event: SseEvent = { data: dataLines.join("\n") };
-    if (eventName !== undefined) event.event = eventName;
-    if (eventId !== undefined) event.id = eventId;
-    dataLines = [];
-    eventName = undefined;
-    return event;
-  };
-
-  try {
-    while (true) {
-      const { done, value } = await reader.read();
-      if (done) break;
-      buffer += decoder.decode(value, { stream: true });
-      let newline: number;
-      while ((newline = buffer.indexOf("\n")) !== -1) {
-        const hasCr = newline > 0 && buffer[newline - 1] === "\r";
-        const line = buffer.slice(0, hasCr ? newline - 1 : newline);
-        buffer = buffer.slice(newline + 1);
-        if (line === "") {
-          const event = flush();
-          if (event) yield event;
-        } else if (line.startsWith("data:")) {
-          dataLines.push(line.slice(5).replace(/^ /, ""));
-        } else if (line.startsWith("event:")) {
-          eventName = line.slice(6).replace(/^ /, "");
-        } else if (line.startsWith("id:")) {
-          eventId = line.slice(3).replace(/^ /, "");
-        }
-        // comments (":") and "retry:" are intentionally ignored
-      }
-    }
-    const last = flush();
-    if (last) yield last;
-  } finally {
-    reader.releaseLock();
-  }
-}
 
 /** Default rendering for debug events (the boolean debug:true sink). */
 export function formatDebugEvent(name: string, event: DebugEvent): string {
@@ -833,74 +732,6 @@ export function bearerAuth(token: AuthValue): AuthValue {
   return "Bearer " + token;
 }
 
-export interface ClientCredentialsConfig {
-  clientId: string;
-  clientSecret: string;
-  tokenUrl: string;
-  scopes?: string[];
-  /** Extra token-request parameters, e.g. the "audience" some
-   * authorization servers require for API-valid access tokens. */
-  tokenParams?: Record<string, string>;
-  /** How credentials reach the token endpoint. Default "post"
-   * (client_secret_post, form fields); "basic" sends an Authorization
-   * header (client_secret_basic). */
-  authMethod?: "post" | "basic";
-  fetchImpl?: typeof fetch;
-}
-
-/**
- * OAuth2 client-credentials token source: fetches from the token URL,
- * caches until expiry (60s early refresh), and shares one in-flight
- * request across concurrent callers. Returned function plugs in as an
- * Authorization AuthValue, resolved before every attempt.
- */
-export function oauthClientCredentials(config: ClientCredentialsConfig): () => Promise<string> {
-  let token: string | undefined;
-  let expiresAt = 0;
-  let inflight: Promise<string> | undefined;
-  const fetchImpl = config.fetchImpl ?? fetch;
-
-  async function fetchToken(): Promise<string> {
-    const params = new URLSearchParams({ grant_type: "client_credentials" });
-    if (config.scopes !== undefined && config.scopes.length > 0) {
-      params.set("scope", config.scopes.join(" "));
-    }
-    for (const [key, value] of Object.entries(config.tokenParams ?? {})) {
-      params.set(key, value);
-    }
-    const headers: Record<string, string> = {
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json",
-    };
-    if (config.authMethod === "basic") {
-      headers["Authorization"] = "Basic " + toBase64(config.clientId + ":" + config.clientSecret);
-    } else {
-      params.set("client_id", config.clientId);
-      params.set("client_secret", config.clientSecret);
-    }
-    const response = await fetchImpl(config.tokenUrl, { method: "POST", headers, body: params.toString() });
-    const body = (await response.json().catch(() => null)) as
-      | { access_token?: string; expires_in?: number; error?: string }
-      | null;
-    if (!response.ok || typeof body?.access_token !== "string") {
-      throw new TransportError(
-        "OAuth token request failed (HTTP " + response.status + (body?.error ? ": " + body.error : "") + ")",
-        body,
-      );
-    }
-    token = body.access_token;
-    expiresAt = body.expires_in !== undefined
-      ? Date.now() + body.expires_in * 1000 - 60_000
-      : Number.MAX_SAFE_INTEGER;
-    return token;
-  }
-
-  return async () => {
-    if (token !== undefined && Date.now() < expiresAt) return "Bearer " + token;
-    inflight ??= fetchToken().finally(() => { inflight = undefined; });
-    return "Bearer " + (await inflight);
-  };
-}
 
 /**
  * Bracket-style deep encoding shared by query strings and form bodies:
@@ -925,60 +756,80 @@ function serializeBody(req: CoreRequest): { body: NonNullable<RequestInit["body"
   switch (req.bodyKind ?? "json") {
     case "json":
       return { body: JSON.stringify(req.body), contentType: "application/json" };
-    case "form": {
-      const params = new URLSearchParams();
-      for (const [k, v] of Object.entries(req.body as Record<string, unknown>)) {
-        appendDeep(params, k, v);
-      }
-      // URLSearchParams sets its own content type with the charset suffix.
-      return { body: params };
-    }
-    case "multipart": {
-      const form = new FormData();
-      for (const [k, v] of Object.entries(req.body as Record<string, unknown>)) {
-        if (v === undefined || v === null) continue;
-        form.append(
-          k,
-          v instanceof Blob ? v : typeof v === "object" ? JSON.stringify(v) : String(v),
-        );
-      }
-      // Let fetch set the boundary header.
-      return { body: form };
-    }
-    case "text":
-      return { body: String(req.body), contentType: "text/plain" };
-    case "binary":
-      return { body: req.body as NonNullable<RequestInit["body"]> };
   }
+  throw new Error("Unsupported request body kind: " + String(req.bodyKind));
 }
 
 async function parseBody(response: Response, method: string): Promise<unknown> {
   if (method === "HEAD" || response.status === 204 || response.status === 205) return undefined;
-  const contentType = response.headers.get("content-type") ?? "";
+  const contentType = (response.headers.get("content-type") ?? "").toLowerCase();
+  const mediaType = contentType.split(";", 1)[0]!.trim();
+  const slash = mediaType.indexOf("/");
+  const subtype = slash === -1 ? "" : mediaType.slice(slash + 1);
   try {
-    if (contentType.includes("json")) return await response.json();
+    if (subtype === "json" || subtype.endsWith("+json")) {
+      const body = await response.text();
+      if (body.length === 0) return undefined;
+      try {
+        return JSON.parse(body);
+      } catch (cause) {
+        throw new ResponseParseError(body, meta(response, body), cause);
+      }
+    }
     if (contentType.startsWith("text/")) return await response.text();
     if (response.body === null) return undefined;
     return await response.blob();
   } catch (cause) {
-    // A timed-out or aborted body read is a transport failure, not an
-    // empty body — surface it instead of faking success.
-    if (cause instanceof Error && (cause.name === "AbortError" || cause.name === "TimeoutError")) throw cause;
-    return undefined;
+    if (cause instanceof ResponseParseError) throw cause;
+    // A timed-out, aborted, or prematurely terminated body is a transport
+    // failure, not an empty body — surface it instead of faking success.
+    throw cause;
   }
 }
 
-function meta(response: Response): ResponseMeta {
+function requestIdFromBody(body: unknown): string | undefined {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return undefined;
+  const value = (body as Record<string, unknown>).request_id ?? (body as Record<string, unknown>).requestId;
+  return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+
+function meta(response: Response, body?: unknown): ResponseMeta {
   return {
     status: response.status,
     headers: response.headers,
+    ...(body !== undefined ? { rawBody: body } : {}),
     requestId:
-      response.headers.get("x-request-id") ??
+      requestIdFromBody(body) ??
       response.headers.get("request-id") ??
+      response.headers.get("x-request-id") ??
       undefined,
   };
 }
 
+/** AbortSignal.any reached Node in 18.17. Keep the package's Node 18 floor
+ * honest for earlier 18.x releases and for web runtimes without it. */
+function composeSignals(signals: AbortSignal[]): AbortSignal {
+  const nativeAny = (AbortSignal as typeof AbortSignal & { any?: (items: AbortSignal[]) => AbortSignal }).any;
+  if (nativeAny) return nativeAny.call(AbortSignal, signals);
+  const controller = new AbortController();
+  const listeners = new Map<AbortSignal, () => void>();
+  const abortFrom = (signal: AbortSignal) => {
+    for (const [item, listener] of listeners) item.removeEventListener("abort", listener);
+    listeners.clear();
+    controller.abort(signal.reason);
+  };
+  for (const signal of signals) {
+    if (signal.aborted) {
+      abortFrom(signal);
+      break;
+    }
+    const listener = () => abortFrom(signal);
+    listeners.set(signal, listener);
+    signal.addEventListener("abort", listener, { once: true });
+  }
+  return controller.signal;
+}
+
 function retryAfterMs(response: Response): number | undefined {
   const header = response.headers.get("retry-after");
   if (!header) return undefined;