@typeship-ax/mcp 0.6.0

package/dist/core/http.js

@@ -0,0 +1,770 @@
+/**
+ * Runtime core. Generated by typeship — https://typeship.dev
+ * Zero dependencies: built on the platform fetch API (Node 18+, browsers, edge).
+ */
+/** Collapse a result into its data, throwing the typed error when !ok. */
+export function unwrap(result) {
+    if (result.ok)
+        return result.data;
+    if (result.error instanceof Error)
+        throw result.error;
+    throw new Error(String(result.error));
+}
+/** Base class for every HTTP error response. */
+export class ApiError extends Error {
+    status;
+    body;
+    response;
+    constructor(message, status, body, response) {
+        super(message);
+        this.name = new.target.name;
+        this.status = status;
+        this.body = body;
+        this.response = response;
+    }
+}
+/** A response status the spec didn't document. */
+export class UnexpectedApiError extends ApiError {
+    constructor(status, body, response) {
+        super("Unexpected HTTP status " + status, status, body, response);
+    }
+}
+/** A 200 response whose GraphQL payload carried errors. */
+export class GraphQLRequestError extends Error {
+    /** The raw errors array from the GraphQL response. */
+    errors;
+    response;
+    constructor(errors, response) {
+        const first = errors[0]?.message;
+        super(first ?? "GraphQL request returned errors");
+        this.name = "GraphQLRequestError";
+        this.errors = errors;
+        this.response = response;
+    }
+}
+/** Serialize a selection object to a GraphQL selection set. Strings pass
+ * through untouched. */
+export function selectionToString(selection) {
+    if (typeof selection === "string")
+        return selection;
+    const parts = [];
+    for (const [key, value] of Object.entries(selection)) {
+        if (!value)
+            continue;
+        if (key === "on" && typeof value === "object") {
+            for (const [typeName, sub] of Object.entries(value)) {
+                if (sub && typeof sub === "object")
+                    parts.push("... on " + typeName + " " + selectionToString(sub));
+            }
+        }
+        else if (value === true) {
+            parts.push(key);
+        }
+        else if (typeof value === "object") {
+            parts.push(key + " " + selectionToString(value));
+        }
+    }
+    return "{ " + (parts.length > 0 ? parts.join(" ") : "__typename") + " }";
+}
+/** Request or response data did not match the spec's schema (opt-in via the
+ * client's validate option). Never thrown: returned as the error side of
+ * ApiResult, like every other failure. */
+export class ValidationError extends Error {
+    direction;
+    violations;
+    constructor(direction, violations) {
+        const shown = violations.slice(0, 3).map((v) => v.path + " " + v.message).join("; ");
+        super(direction + " body failed schema validation: " + shown
+            + (violations.length > 3 ? " (+" + (violations.length - 3) + " more)" : ""));
+        this.name = "ValidationError";
+        this.direction = direction;
+        this.violations = violations;
+    }
+}
+function jsonType(value) {
+    if (value === null)
+        return "null";
+    if (Array.isArray(value))
+        return "array";
+    return typeof value;
+}
+function typeMatches(value, t) {
+    if (t === "integer")
+        return typeof value === "number" && Number.isInteger(value);
+    return jsonType(value) === t;
+}
+const MAX_VIOLATIONS = 50;
+/**
+ * Validates against the depth-capped JSON Schema subset emitted in
+ * schemas.ts. Constraints outside the subset (formats, multipleOf, not, ...)
+ * are ignored: validation can miss drift but never false-alarms.
+ */
+export function validateAgainstSchema(value, schema, path, out, defs) {
+    if (out.length >= MAX_VIOLATIONS)
+        return;
+    if (!schema || typeof schema !== "object" || Array.isArray(schema))
+        return;
+    const s = schema;
+    // Named components are deduplicated into the DEFS table (see schemas.ts);
+    // recursion is bounded by the data's own depth, so cycles terminate.
+    if (typeof s.$ref === "string") {
+        validateAgainstSchema(value, defs?.[s.$ref], path, out, defs);
+        return;
+    }
+    if (Array.isArray(s.allOf))
+        for (const sub of s.allOf)
+            validateAgainstSchema(value, sub, path, out, defs);
+    const variants = s.anyOf ?? s.oneOf;
+    if (Array.isArray(variants) && variants.length > 0) {
+        const matched = variants.some((sub) => {
+            const scratch = [];
+            validateAgainstSchema(value, sub, path, scratch, defs);
+            return scratch.length === 0;
+        });
+        if (!matched)
+            out.push({ path, message: "matches none of the allowed variants" });
+    }
+    if (s.type !== undefined) {
+        const allowed = Array.isArray(s.type) ? s.type : [s.type];
+        if (s.nullable === true && !allowed.includes("null"))
+            allowed.push("null");
+        if (!allowed.some((t) => typeMatches(value, t))) {
+            out.push({ path, message: "expected " + allowed.join(" | ") + ", got " + jsonType(value) });
+            return; // remaining constraints assume the right type
+        }
+    }
+    if (value === null)
+        return;
+    if (Array.isArray(s.enum) && !s.enum.some((e) => JSON.stringify(e) === JSON.stringify(value))) {
+        out.push({ path, message: "not one of the allowed enum values" });
+    }
+    if (s.const !== undefined && JSON.stringify(s.const) !== JSON.stringify(value)) {
+        out.push({ path, message: "does not equal the required constant" });
+    }
+    if (typeof value === "number") {
+        if (typeof s.minimum === "number" && value < s.minimum)
+            out.push({ path, message: "below minimum " + s.minimum });
+        if (typeof s.maximum === "number" && value > s.maximum)
+            out.push({ path, message: "above maximum " + s.maximum });
+    }
+    if (typeof value === "string") {
+        if (typeof s.minLength === "number" && value.length < s.minLength)
+            out.push({ path, message: "shorter than minLength " + s.minLength });
+        if (typeof s.maxLength === "number" && value.length > s.maxLength)
+            out.push({ path, message: "longer than maxLength " + s.maxLength });
+        if (typeof s.pattern === "string") {
+            try {
+                if (!new RegExp(s.pattern).test(value))
+                    out.push({ path, message: "does not match pattern" });
+            }
+            catch { /* invalid pattern in the spec: skip, never false-alarm */ }
+        }
+    }
+    if (Array.isArray(value)) {
+        if (typeof s.minItems === "number" && value.length < s.minItems)
+            out.push({ path, message: "fewer than minItems " + s.minItems });
+        if (typeof s.maxItems === "number" && value.length > s.maxItems)
+            out.push({ path, message: "more than maxItems " + s.maxItems });
+        if (s.items) {
+            for (let i = 0; i < value.length && out.length < MAX_VIOLATIONS; i++) {
+                validateAgainstSchema(value[i], s.items, path + "[" + i + "]", out, defs);
+            }
+        }
+    }
+    if (jsonType(value) === "object") {
+        const obj = value;
+        if (Array.isArray(s.required)) {
+            for (const key of s.required) {
+                if (obj[key] === undefined)
+                    out.push({ path, message: "missing required property " + JSON.stringify(key) });
+            }
+        }
+        if (s.properties && typeof s.properties === "object") {
+            for (const [key, sub] of Object.entries(s.properties)) {
+                if (obj[key] !== undefined)
+                    validateAgainstSchema(obj[key], sub, path + "." + key, out, defs);
+            }
+            if (s.additionalProperties === false) {
+                for (const key of Object.keys(obj)) {
+                    if (!(key in s.properties))
+                        out.push({ path, message: "unexpected property " + JSON.stringify(key) });
+                }
+            }
+        }
+    }
+}
+/**
+ * "fetch failed" alone is useless in a bug report; surface the request line
+ * and the deepest cause message (getaddrinfo ENOTFOUND, ECONNREFUSED, ...)
+ * the platform buried in the error chain.
+ */
+function transportFailureMessage(method, url, cause) {
+    let detail = cause instanceof Error ? cause.message : String(cause ?? "request failed");
+    let node = cause;
+    for (let depth = 0; depth < 5 && node instanceof Error; depth++) {
+        node = Array.isArray(node.errors)
+            ? node.errors[0]
+            : node.cause;
+        if (node instanceof Error && node.message && !detail.includes(node.message)) {
+            detail += ": " + node.message;
+        }
+    }
+    return method + " " + url + " failed: " + detail;
+}
+/** The request never produced an HTTP response (network failure, timeout, abort). */
+export class TransportError extends Error {
+    cause;
+    constructor(message, cause) {
+        super(message);
+        this.name = "TransportError";
+        this.cause = cause;
+    }
+}
+const RETRYABLE_STATUSES = new Set([408, 429, 500, 502, 503, 504]);
+/** Credential-bearing headers fetch itself drops when a redirect crosses to
+ * another origin. A spec's own API-key headers join them below. */
+const SENSITIVE_HEADERS = ["authorization", "cookie", "cookie2", "proxy-authorization", "www-authenticate"];
+const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+/** Dropped along with the body when a redirect rewrites the method to GET. */
+const CONTENT_HEADERS = ["content-encoding", "content-language", "content-location", "content-type", "content-length"];
+/** fetch's own ceiling, so a redirect loop fails the same way it did before. */
+const MAX_REDIRECTS = 20;
+function withoutHeaders(headers, drop) {
+    const kept = {};
+    for (const [name, value] of Object.entries(headers)) {
+        if (!drop.includes(name.toLowerCase()))
+            kept[name] = value;
+    }
+    return kept;
+}
+/** A body that can only be read once, so a redirect cannot replay it. */
+function isStreamBody(body) {
+    return typeof body?.getReader === "function";
+}
+export class HttpCore {
+    config;
+    /** Lowercased header names dropped on a cross-origin hop. */
+    sensitiveHeaders;
+    /** Whether this runtime follows redirects itself instead of letting the
+     * platform do it — see followRedirects(). */
+    manualRedirects;
+    // no parameter properties: this file also runs under strip-only TS
+    constructor(config) {
+        this.config = config;
+        const declared = (config.authHeaders ?? []).map((name) => name.toLowerCase());
+        const custom = declared.filter((name, i) => !SENSITIVE_HEADERS.includes(name) && declared.indexOf(name) === i);
+        this.sensitiveHeaders = [...SENSITIVE_HEADERS, ...custom];
+        // Only worth taking over from the platform when the spec puts its
+        // credential on a header fetch has never heard of. A browser is excluded:
+        // there, `redirect: "manual"` yields an opaque response with no Location
+        // to read, and a cross-origin hop carrying a non-safelisted header needs
+        // the target's CORS consent anyway.
+        this.manualRedirects = custom.length > 0 && globalThis.document === undefined;
+    }
+    /** The client-level value for an x-typeship-globals parameter. */
+    globalValue(name) {
+        return this.config.globals?.[name];
+    }
+    async request(req) {
+        const policy = { ...this.config.retry, ...req.retry };
+        const maxRetries = req.options?.maxRetries ?? policy.maxRetries ?? this.config.maxRetries;
+        const timeoutMs = req.options?.timeoutMs ?? this.config.timeoutMs;
+        const retryAllowed = req.idempotent === true || req.method === "GET" || policy.retryNonIdempotent === true;
+        const retryableStatuses = policy.statuses ? new Set(policy.statuses) : RETRYABLE_STATUSES;
+        // One key per logical call, reused on every retry — that's the point
+        // of idempotency keys.
+        const autoIdempotencyKey = req.idempotencyKey !== undefined &&
+            req.headers?.[req.idempotencyKey] === undefined &&
+            req.options?.headers?.[req.idempotencyKey] === undefined
+            ? crypto.randomUUID()
+            : undefined;
+        const opSchemas = this.config.validate && req.schemaKey ? this.config.schemas?.[req.schemaKey] : undefined;
+        if (opSchemas?.req && this.config.validate.requests
+            && req.body !== undefined && (req.bodyKind ?? "json") === "json") {
+            const violations = [];
+            validateAgainstSchema(req.body, opSchemas.req, "body", violations, this.config.schemaDefs);
+            if (violations.length > 0) {
+                const validationError = new ValidationError("request", violations);
+                if (this.config.validate.mode === "warn") {
+                    console.warn(req.method + " " + req.path + ": " + validationError.message);
+                }
+                else {
+                    const error = validationError;
+                    await this.config.onError?.(error, { method: req.method, path: req.path });
+                    return { ok: false, error };
+                }
+            }
+        }
+        let lastError;
+        for (let attempt = 0; attempt <= maxRetries; attempt++) {
+            let response;
+            const attemptStarted = Date.now();
+            try {
+                response = await this.send(req, timeoutMs, attempt, autoIdempotencyKey);
+                this.config.debug?.({
+                    method: req.method,
+                    path: req.path,
+                    status: response.status,
+                    durationMs: Date.now() - attemptStarted,
+                    attempt: attempt + 1,
+                    requestId: response.headers.get("x-request-id") ?? response.headers.get("request-id") ?? undefined,
+                });
+            }
+            catch (cause) {
+                lastError = cause;
+                this.config.debug?.({
+                    method: req.method,
+                    path: req.path,
+                    durationMs: Date.now() - attemptStarted,
+                    attempt: attempt + 1,
+                    error: cause instanceof Error ? cause.message : String(cause),
+                });
+                if (attempt < maxRetries && retryAllowed && !req.options?.signal?.aborted) {
+                    await sleep(backoff(attempt, policy));
+                    continue;
+                }
+                const error = new TransportError(transportFailureMessage(req.method, this.config.baseUrl.replace(/\/+$/, "") + req.path, cause), cause);
+                await this.config.onError?.(error, { method: req.method, path: req.path });
+                return { ok: false, error };
+            }
+            if (response.ok) {
+                if (req.stream) {
+                    return { ok: true, data: sseEvents(response), response: meta(response) };
+                }
+                let data;
+                try {
+                    data = (await parseBody(response, req.method));
+                }
+                catch (cause) {
+                    const error = new TransportError("The response body read was aborted before completing", cause);
+                    await this.config.onError?.(error, { method: req.method, path: req.path });
+                    return { ok: false, error, response: meta(response) };
+                }
+                if (opSchemas?.res && this.config.validate.responses && data !== undefined) {
+                    const violations = [];
+                    validateAgainstSchema(data, opSchemas.res, "response", violations, this.config.schemaDefs);
+                    if (violations.length > 0) {
+                        const validationError = new ValidationError("response", violations);
+                        if (this.config.validate.mode === "warn") {
+                            console.warn(req.method + " " + req.path + ": " + validationError.message);
+                        }
+                        else {
+                            const error = validationError;
+                            await this.config.onError?.(error, { method: req.method, path: req.path });
+                            return { ok: false, error, response: meta(response) };
+                        }
+                    }
+                }
+                if (req.graphqlField) {
+                    const payload = data;
+                    const responseMeta = meta(response);
+                    if (Array.isArray(payload?.errors) && payload.errors.length > 0) {
+                        const gqlError = new GraphQLRequestError(payload.errors, responseMeta);
+                        await this.config.onError?.(gqlError, { method: req.method, path: req.path });
+                        return { ok: false, error: gqlError, response: responseMeta };
+                    }
+                    return { ok: true, data: payload?.data?.[req.graphqlField], response: responseMeta };
+                }
+                return { ok: true, data, response: meta(response) };
+            }
+            // 429 is safe to retry regardless of idempotency; other retryable
+            // statuses only when the verb is idempotent.
+            const retryableStatus = retryableStatuses.has(response.status) &&
+                (retryAllowed || response.status === 429);
+            if (attempt < maxRetries && retryableStatus) {
+                await sleep(retryAfterMs(response) ?? backoff(attempt, policy));
+                continue;
+            }
+            let body;
+            try {
+                body = await parseBody(response, req.method);
+            }
+            catch {
+                body = undefined; // error responses keep their status even if the body read aborts
+            }
+            const responseMeta = meta(response);
+            const Ctor = req.errors?.[String(response.status)] ??
+                req.errors?.[String(Math.floor(response.status / 100)) + "XX"] ??
+                req.errors?.["default"];
+            const error = (Ctor
+                ? new Ctor(body, responseMeta)
+                : new UnexpectedApiError(response.status, body, responseMeta));
+            await this.config.onError?.(error, { method: req.method, path: req.path });
+            return { ok: false, error, response: responseMeta };
+        }
+        // Unreachable, but keeps the compiler honest.
+        const error = new TransportError("Request failed", lastError);
+        await this.config.onError?.(error, { method: req.method, path: req.path });
+        return { ok: false, error };
+    }
+    async send(req, timeoutMs, attempt, autoIdempotencyKey) {
+        const headers = {};
+        for (const [k, v] of Object.entries(this.config.headers)) {
+            headers[k] = await resolveAuthValue(v);
+        }
+        if (req.idempotencyKey && autoIdempotencyKey) {
+            headers[req.idempotencyKey] = autoIdempotencyKey;
+        }
+        const { body, contentType } = serializeBody(req);
+        if (contentType)
+            headers["Content-Type"] = contentType;
+        for (const source of [req.headers, req.options?.headers]) {
+            for (const [k, v] of Object.entries(source ?? {})) {
+                if (v !== undefined)
+                    headers[k] = v;
+            }
+        }
+        const context = {
+            method: req.method,
+            url: await this.buildUrl(req),
+            headers,
+            attempt,
+        };
+        await this.config.onRequest?.(context);
+        // Streaming responses are exempt from the attempt timeout once headers
+        // arrive (an event stream may stay open far longer than timeoutMs);
+        // everything else keeps the timeout armed through the body read, so a
+        // stalled body aborts instead of hanging.
+        const signals = [];
+        let clearStreamTimeout;
+        if (req.stream) {
+            const headersTimeout = new AbortController();
+            const timer = setTimeout(() => headersTimeout.abort(new DOMException("Timed out waiting for response headers", "TimeoutError")), timeoutMs);
+            timer.unref?.();
+            clearStreamTimeout = () => clearTimeout(timer);
+            signals.push(headersTimeout.signal);
+        }
+        else {
+            signals.push(AbortSignal.timeout(timeoutMs));
+        }
+        if (req.options?.signal)
+            signals.push(req.options.signal);
+        try {
+            const signal = AbortSignal.any(signals);
+            const response = this.manualRedirects
+                ? await this.followRedirects(context, body, signal)
+                : await this.config.fetch(context.url, {
+                    method: req.method,
+                    headers: context.headers,
+                    body,
+                    signal,
+                });
+            await this.config.onResponse?.(response, context);
+            return response;
+        }
+        finally {
+            clearStreamTimeout?.();
+        }
+    }
+    /**
+     * The redirect chain, walked here instead of inside fetch, so the header
+     * this spec puts its API key on is dropped when a hop crosses to another
+     * origin. fetch drops Authorization and friends for us, but it has never
+     * heard of X-Whatever-Key, and an operation that returns a file commonly
+     * redirects to object storage.
+     *
+     * Only reached when the spec declares such a header (see the constructor);
+     * every other client stays on the platform's own redirect handling. One
+     * chain is one attempt: retries, the per-attempt timeout, the caller's
+     * signal, and the onRequest/onResponse hooks all sit outside it and see
+     * the chain as the single exchange it replaces.
+     */
+    async followRedirects(context, body, signal) {
+        let url = context.url;
+        let origin = new URL(url).origin;
+        let method = context.method;
+        let headers = context.headers;
+        for (let hop = 0;; hop++) {
+            const response = await this.config.fetch(url, { method, headers, body, redirect: "manual", signal });
+            // A runtime that filters manual redirects (a browser) hands back an
+            // opaque response with no Location to read. Refuse rather than let the
+            // credential travel blind — the constructor already keeps browsers off
+            // this path, so this is a guard, not an expected outcome.
+            if (response.type === "opaqueredirect" || response.status === 0) {
+                throw new TransportError("This runtime hides redirect targets, so the credential cannot be dropped before the hop");
+            }
+            const location = response.headers.get("location");
+            if (!REDIRECT_STATUSES.has(response.status) || location === null)
+                return response;
+            if (hop >= MAX_REDIRECTS)
+                throw new TransportError("Too many redirects (" + (hop + 1) + ")");
+            await response.body?.cancel();
+            const target = new URL(location, url);
+            headers = { ...headers };
+            // Origins are compared exactly — scheme, host, and port — which is
+            // fetch's rule and the one the Python runtime applies.
+            if (target.origin !== origin)
+                headers = withoutHeaders(headers, this.sensitiveHeaders);
+            // The method rewrite fetch performs: a 303 continues as a bodyless GET,
+            // and so does a 301/302 that answered a POST.
+            const toGet = response.status === 303
+                ? method !== "HEAD"
+                : (response.status === 301 || response.status === 302) && method === "POST";
+            if (toGet) {
+                method = "GET";
+                body = undefined;
+                headers = withoutHeaders(headers, CONTENT_HEADERS);
+            }
+            else if (isStreamBody(body)) {
+                // A stream reads once; fetch fails the same way rather than sending
+                // an empty body to the new location.
+                throw new TransportError("Cannot replay a streaming request body across a redirect");
+            }
+            url = target.toString();
+            origin = target.origin;
+        }
+    }
+    async buildUrl(req) {
+        const base = this.config.baseUrl.replace(/\/+$/, "");
+        const url = new URL(base + req.path);
+        for (const [k, v] of Object.entries(req.query ?? {})) {
+            if (v === undefined || v === null)
+                continue;
+            if (Array.isArray(v)) {
+                // top-level arrays repeat the key: expand=a&expand=b
+                for (const item of v)
+                    appendDeep(url.searchParams, k, item);
+            }
+            else {
+                appendDeep(url.searchParams, k, v);
+            }
+        }
+        for (const [k, v] of Object.entries(this.config.query)) {
+            url.searchParams.append(k, await resolveAuthValue(v));
+        }
+        return url.toString();
+    }
+}
+async function resolveAuthValue(value) {
+    return typeof value === "function" ? await value() : value;
+}
+/** Parse a text/event-stream body into SseEvents, lazily. */
+async function* sseEvents(response) {
+    if (!response.body)
+        return;
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let buffer = "";
+    let dataLines = [];
+    let eventName;
+    let eventId;
+    const flush = () => {
+        if (dataLines.length === 0)
+            return undefined;
+        const event = { data: dataLines.join("\n") };
+        if (eventName !== undefined)
+            event.event = eventName;
+        if (eventId !== undefined)
+            event.id = eventId;
+        dataLines = [];
+        eventName = undefined;
+        return event;
+    };
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            buffer += decoder.decode(value, { stream: true });
+            let newline;
+            while ((newline = buffer.indexOf("\n")) !== -1) {
+                const hasCr = newline > 0 && buffer[newline - 1] === "\r";
+                const line = buffer.slice(0, hasCr ? newline - 1 : newline);
+                buffer = buffer.slice(newline + 1);
+                if (line === "") {
+                    const event = flush();
+                    if (event)
+                        yield event;
+                }
+                else if (line.startsWith("data:")) {
+                    dataLines.push(line.slice(5).replace(/^ /, ""));
+                }
+                else if (line.startsWith("event:")) {
+                    eventName = line.slice(6).replace(/^ /, "");
+                }
+                else if (line.startsWith("id:")) {
+                    eventId = line.slice(3).replace(/^ /, "");
+                }
+                // comments (":") and "retry:" are intentionally ignored
+            }
+        }
+        const last = flush();
+        if (last)
+            yield last;
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
+/** Default rendering for debug events (the boolean debug:true sink). */
+export function formatDebugEvent(name, event) {
+    return name + " " + event.method + " " + event.path +
+        " -> " + (event.status !== undefined ? String(event.status) : "error") +
+        " (" + event.durationMs + "ms)" +
+        (event.attempt > 1 ? " attempt " + event.attempt : "") +
+        (event.requestId !== undefined ? " " + event.requestId : "") +
+        (event.error !== undefined ? ": " + event.error : "");
+}
+/** Wrap a bearer credential (static or callback) as an Authorization value. */
+export function bearerAuth(token) {
+    if (typeof token === "function") {
+        return async () => "Bearer " + (await token());
+    }
+    return "Bearer " + token;
+}
+/**
+ * OAuth2 client-credentials token source: fetches from the token URL,
+ * caches until expiry (60s early refresh), and shares one in-flight
+ * request across concurrent callers. Returned function plugs in as an
+ * Authorization AuthValue, resolved before every attempt.
+ */
+export function oauthClientCredentials(config) {
+    let token;
+    let expiresAt = 0;
+    let inflight;
+    const fetchImpl = config.fetchImpl ?? fetch;
+    async function fetchToken() {
+        const params = new URLSearchParams({ grant_type: "client_credentials" });
+        if (config.scopes !== undefined && config.scopes.length > 0) {
+            params.set("scope", config.scopes.join(" "));
+        }
+        for (const [key, value] of Object.entries(config.tokenParams ?? {})) {
+            params.set(key, value);
+        }
+        const headers = {
+            "Content-Type": "application/x-www-form-urlencoded",
+            Accept: "application/json",
+        };
+        if (config.authMethod === "basic") {
+            headers["Authorization"] = "Basic " + toBase64(config.clientId + ":" + config.clientSecret);
+        }
+        else {
+            params.set("client_id", config.clientId);
+            params.set("client_secret", config.clientSecret);
+        }
+        const response = await fetchImpl(config.tokenUrl, { method: "POST", headers, body: params.toString() });
+        const body = (await response.json().catch(() => null));
+        if (!response.ok || typeof body?.access_token !== "string") {
+            throw new TransportError("OAuth token request failed (HTTP " + response.status + (body?.error ? ": " + body.error : "") + ")", body);
+        }
+        token = body.access_token;
+        expiresAt = body.expires_in !== undefined
+            ? Date.now() + body.expires_in * 1000 - 60_000
+            : Number.MAX_SAFE_INTEGER;
+        return token;
+    }
+    return async () => {
+        if (token !== undefined && Date.now() < expiresAt)
+            return "Bearer " + token;
+        inflight ??= fetchToken().finally(() => { inflight = undefined; });
+        return "Bearer " + (await inflight);
+    };
+}
+/**
+ * Bracket-style deep encoding shared by query strings and form bodies:
+ * { created: { gte: 5 } } -> created[gte]=5, { items: [{ id: "x" }] } ->
+ * items[0][id]=x. Scalars append as-is.
+ */
+function appendDeep(target, key, value) {
+    if (value === undefined || value === null)
+        return;
+    if (Array.isArray(value)) {
+        value.forEach((item, i) => appendDeep(target, key + "[" + i + "]", item));
+    }
+    else if (typeof value === "object" && !(value instanceof Blob) && !(value instanceof Date)) {
+        for (const [k, v] of Object.entries(value)) {
+            appendDeep(target, key + "[" + k + "]", v);
+        }
+    }
+    else {
+        target.append(key, value instanceof Date ? value.toISOString() : String(value));
+    }
+}
+function serializeBody(req) {
+    if (req.body === undefined)
+        return { body: undefined };
+    switch (req.bodyKind ?? "json") {
+        case "json":
+            return { body: JSON.stringify(req.body), contentType: "application/json" };
+        case "form": {
+            const params = new URLSearchParams();
+            for (const [k, v] of Object.entries(req.body)) {
+                appendDeep(params, k, v);
+            }
+            // URLSearchParams sets its own content type with the charset suffix.
+            return { body: params };
+        }
+        case "multipart": {
+            const form = new FormData();
+            for (const [k, v] of Object.entries(req.body)) {
+                if (v === undefined || v === null)
+                    continue;
+                form.append(k, v instanceof Blob ? v : typeof v === "object" ? JSON.stringify(v) : String(v));
+            }
+            // Let fetch set the boundary header.
+            return { body: form };
+        }
+        case "text":
+            return { body: String(req.body), contentType: "text/plain" };
+        case "binary":
+            return { body: req.body };
+    }
+}
+async function parseBody(response, method) {
+    if (method === "HEAD" || response.status === 204 || response.status === 205)
+        return undefined;
+    const contentType = response.headers.get("content-type") ?? "";
+    try {
+        if (contentType.includes("json"))
+            return await response.json();
+        if (contentType.startsWith("text/"))
+            return await response.text();
+        if (response.body === null)
+            return undefined;
+        return await response.blob();
+    }
+    catch (cause) {
+        // A timed-out or aborted body read is a transport failure, not an
+        // empty body — surface it instead of faking success.
+        if (cause instanceof Error && (cause.name === "AbortError" || cause.name === "TimeoutError"))
+            throw cause;
+        return undefined;
+    }
+}
+function meta(response) {
+    return {
+        status: response.status,
+        headers: response.headers,
+        requestId: response.headers.get("x-request-id") ??
+            response.headers.get("request-id") ??
+            undefined,
+    };
+}
+function retryAfterMs(response) {
+    const header = response.headers.get("retry-after");
+    if (!header)
+        return undefined;
+    const seconds = Number(header);
+    if (Number.isFinite(seconds))
+        return Math.min(seconds * 1000, 60_000);
+    const date = Date.parse(header);
+    if (!Number.isNaN(date))
+        return Math.min(Math.max(date - Date.now(), 0), 60_000);
+    return undefined;
+}
+/** Exponential backoff with full jitter, capped at 10s by default. */
+function backoff(attempt, policy) {
+    const initial = policy?.initialDelayMs ?? 300;
+    const max = policy?.maxDelayMs ?? 10_000;
+    const cap = Math.min(initial * 2 ** attempt, max);
+    return Math.random() * cap;
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+export function toBase64(input) {
+    if (typeof btoa === "function")
+        return btoa(input);
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    return globalThis.Buffer.from(input, "utf-8").toString("base64");
+}