@usepylon/sdk 0.0.0-stage → 0.1.0-alpha.3

package/dist/esm/core/fetcher/makePassthroughRequest.js

@@ -0,0 +1,170 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { createLogger } from "../logging/logger.js";
+import { join } from "../url/join.js";
+import { EndpointSupplier } from "./EndpointSupplier.js";
+import { getFetchFn } from "./getFetchFn.js";
+import { makeRequest } from "./makeRequest.js";
+import { redactUrl } from "./redactUrl.js";
+import { requestWithRetries } from "./requestWithRetries.js";
+import { Supplier } from "./Supplier.js";
+import { TIMEOUT } from "./signals.js";
+/**
+ * Makes a passthrough HTTP request using the SDK's configuration (auth, retry, logging, etc.)
+ * while mimicking the standard `fetch` API.
+ *
+ * @param input - The URL, path, or Request object. If a relative path, it will be resolved against the configured base URL.
+ * @param init - Standard RequestInit options (method, headers, body, signal, etc.)
+ * @param clientOptions - SDK client options (auth, default headers, logging, etc.)
+ * @param requestOptions - Per-request overrides (timeout, retries, extra headers, abort signal).
+ * @returns A standard Response object.
+ */
+export function makePassthroughRequest(input, init, clientOptions, requestOptions) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c, _d, _e, _f, _g;
+        const logger = createLogger(clientOptions.logging);
+        // Extract URL and default init properties from Request object if provided
+        let url;
+        let effectiveInit = init;
+        if (input instanceof Request) {
+            url = input.url;
+            // If no explicit init provided, extract properties from the Request object
+            if (init == null) {
+                effectiveInit = {
+                    method: input.method,
+                    headers: Object.fromEntries(input.headers.entries()),
+                    body: input.body,
+                    signal: input.signal,
+                    credentials: input.credentials,
+                    cache: input.cache,
+                    redirect: input.redirect,
+                    referrer: input.referrer,
+                    integrity: input.integrity,
+                    mode: input.mode,
+                };
+            }
+        }
+        else {
+            url = input instanceof URL ? input.toString() : input;
+        }
+        // Resolve the base URL
+        const baseUrl = (_a = (clientOptions.baseUrl != null ? yield Supplier.get(clientOptions.baseUrl) : undefined)) !== null && _a !== void 0 ? _a : (clientOptions.environment != null ? yield Supplier.get(clientOptions.environment) : undefined);
+        // Determine the full URL
+        let fullUrl;
+        if (url.startsWith("http://") || url.startsWith("https://")) {
+            fullUrl = url;
+        }
+        else if (baseUrl != null) {
+            fullUrl = join(baseUrl, url);
+        }
+        else {
+            fullUrl = url;
+        }
+        // Merge headers: SDK default headers -> auth headers -> user-provided headers
+        const mergedHeaders = {};
+        // Apply SDK default headers (resolve suppliers)
+        if (clientOptions.headers != null) {
+            for (const [key, value] of Object.entries(clientOptions.headers)) {
+                const resolved = yield EndpointSupplier.get(value, { endpointMetadata: {} });
+                if (resolved != null) {
+                    mergedHeaders[key.toLowerCase()] = `${resolved}`;
+                }
+            }
+        }
+        // Apply auth headers, but only when the resolved URL targets the configured base URL.
+        // This prevents the SDK's credentials from leaking to an unrelated host when a caller
+        // passes an absolute cross-origin URL into the passthrough fetch escape hatch.
+        if (clientOptions.getAuthHeaders != null && targetsBaseUrl(fullUrl, baseUrl)) {
+            const authHeaders = yield clientOptions.getAuthHeaders();
+            for (const [key, value] of Object.entries(authHeaders)) {
+                mergedHeaders[key.toLowerCase()] = value;
+            }
+        }
+        // Apply user-provided headers from init
+        if ((effectiveInit === null || effectiveInit === void 0 ? void 0 : effectiveInit.headers) != null) {
+            const initHeaders = effectiveInit.headers instanceof Headers
+                ? Object.fromEntries(effectiveInit.headers.entries())
+                : Array.isArray(effectiveInit.headers)
+                    ? Object.fromEntries(effectiveInit.headers)
+                    : effectiveInit.headers;
+            for (const [key, value] of Object.entries(initHeaders)) {
+                if (value != null) {
+                    mergedHeaders[key.toLowerCase()] = value;
+                }
+            }
+        }
+        // Apply per-request option headers (highest priority)
+        if ((requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.headers) != null) {
+            for (const [key, value] of Object.entries(requestOptions.headers)) {
+                mergedHeaders[key.toLowerCase()] = value;
+            }
+        }
+        const method = (_b = effectiveInit === null || effectiveInit === void 0 ? void 0 : effectiveInit.method) !== null && _b !== void 0 ? _b : "GET";
+        const body = effectiveInit === null || effectiveInit === void 0 ? void 0 : effectiveInit.body;
+        const timeoutInSeconds = (_c = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.timeoutInSeconds) !== null && _c !== void 0 ? _c : clientOptions.timeoutInSeconds;
+        const timeoutMs = timeoutInSeconds != null ? timeoutInSeconds * 1000 : undefined;
+        const maxRetries = (_d = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.maxRetries) !== null && _d !== void 0 ? _d : clientOptions.maxRetries;
+        const abortSignal = (_f = (_e = requestOptions === null || requestOptions === void 0 ? void 0 : requestOptions.abortSignal) !== null && _e !== void 0 ? _e : effectiveInit === null || effectiveInit === void 0 ? void 0 : effectiveInit.signal) !== null && _f !== void 0 ? _f : undefined;
+        const fetchFn = (_g = clientOptions.fetch) !== null && _g !== void 0 ? _g : (yield getFetchFn());
+        if (logger.isDebug()) {
+            logger.debug("Making passthrough HTTP request", {
+                method,
+                url: redactUrl(fullUrl),
+                hasBody: body != null,
+            });
+        }
+        let response;
+        try {
+            response = yield requestWithRetries(() => __awaiter(this, void 0, void 0, function* () {
+                return makeRequest(fetchFn, fullUrl, method, mergedHeaders, body !== null && body !== void 0 ? body : undefined, timeoutMs, abortSignal, (effectiveInit === null || effectiveInit === void 0 ? void 0 : effectiveInit.credentials) === "include", undefined, // duplex
+                false);
+            }), maxRetries, abortSignal);
+        }
+        catch (error) {
+            // Match `fetch`: a timeout rejects with an Error named "TimeoutError", not the bare abort reason.
+            if (error === TIMEOUT) {
+                throw createTimeoutError();
+            }
+            throw error;
+        }
+        if (logger.isDebug()) {
+            logger.debug("Passthrough HTTP request completed", {
+                method,
+                url: redactUrl(fullUrl),
+                statusCode: response.status,
+            });
+        }
+        return response;
+    });
+}
+function createTimeoutError() {
+    const error = new Error("The request timed out.");
+    error.name = "TimeoutError";
+    return error;
+}
+/**
+ * Returns true when the resolved request URL points at the same origin as the
+ * configured base URL. Relative paths are always joined onto the base URL, so
+ * they resolve to the base origin and return true. Absolute URLs only match when
+ * their origin equals the base origin. When there is no base URL to compare
+ * against, or either value is not a parseable absolute URL, this returns false so
+ * auth headers are not attached.
+ */
+function targetsBaseUrl(fullUrl, baseUrl) {
+    if (baseUrl == null) {
+        return false;
+    }
+    try {
+        return new URL(fullUrl).origin === new URL(baseUrl).origin;
+    }
+    catch (_a) {
+        return false;
+    }
+}

package/dist/esm/core/fetcher/makeRequest.d.ts

@@ -0,0 +1,11 @@
+export declare function isCacheNoStoreSupported(): boolean;
+/**
+ * Reset the cached result of `isCacheNoStoreSupported`. Exposed for testing only.
+ */
+export declare function resetCacheNoStoreSupported(): void;
+/**
+ * Clears the timeout that `makeRequest` kept running (with `keepTimeoutUntilBodyRead`) so that it also
+ * covered reading the response body.
+ */
+export declare function clearResponseTimeout(response: Response): void;
+export declare const makeRequest: (fetchFn: (url: string, init: RequestInit) => Promise<Response>, url: string, method: string, headers: Headers | Record<string, string>, requestBody: BodyInit | undefined, timeoutMs?: number, abortSignal?: AbortSignal, withCredentials?: boolean, duplex?: "half", disableCache?: boolean, keepTimeoutUntilBodyRead?: boolean) => Promise<Response>;

package/dist/esm/core/fetcher/makeRequest.js

@@ -0,0 +1,87 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { anySignal, getTimeoutSignal, TIMEOUT } from "./signals.js";
+/**
+ * Cached result of checking whether the current runtime supports
+ * the `cache` option in `Request`. Some runtimes (e.g. Cloudflare Workers)
+ * throw a TypeError when this option is used.
+ */
+let _cacheNoStoreSupported;
+export function isCacheNoStoreSupported() {
+    if (_cacheNoStoreSupported != null) {
+        return _cacheNoStoreSupported;
+    }
+    try {
+        new Request("http://localhost", { cache: "no-store" });
+        _cacheNoStoreSupported = true;
+    }
+    catch (_a) {
+        _cacheNoStoreSupported = false;
+    }
+    return _cacheNoStoreSupported;
+}
+/**
+ * Reset the cached result of `isCacheNoStoreSupported`. Exposed for testing only.
+ */
+export function resetCacheNoStoreSupported() {
+    _cacheNoStoreSupported = undefined;
+}
+const responseTimeouts = new WeakMap();
+/**
+ * Clears the timeout that `makeRequest` kept running (with `keepTimeoutUntilBodyRead`) so that it also
+ * covered reading the response body.
+ */
+export function clearResponseTimeout(response) {
+    const timeoutId = responseTimeouts.get(response);
+    if (timeoutId != null) {
+        clearTimeout(timeoutId);
+        responseTimeouts.delete(response);
+    }
+}
+export const makeRequest = (fetchFn, url, method, headers, requestBody, timeoutMs, abortSignal, withCredentials, duplex, disableCache, keepTimeoutUntilBodyRead) => __awaiter(void 0, void 0, void 0, function* () {
+    const signals = [];
+    let timeoutAbortId;
+    let timeoutSignal;
+    if (timeoutMs != null) {
+        const { signal, abortId } = getTimeoutSignal(timeoutMs);
+        timeoutAbortId = abortId;
+        timeoutSignal = signal;
+        signals.push(signal);
+    }
+    if (abortSignal != null) {
+        signals.push(abortSignal);
+    }
+    const newSignals = anySignal(signals);
+    let response;
+    try {
+        response = yield fetchFn(url, Object.assign({ method: method, headers, body: requestBody, signal: newSignals, credentials: withCredentials ? "include" : undefined, 
+            // @ts-ignore
+            duplex }, (disableCache && isCacheNoStoreSupported() ? { cache: "no-store" } : {})));
+    }
+    catch (error) {
+        if (timeoutAbortId != null) {
+            clearTimeout(timeoutAbortId);
+        }
+        // Some runtimes (e.g. Node 18) reject with their own error instead of the abort reason.
+        if ((timeoutSignal === null || timeoutSignal === void 0 ? void 0 : timeoutSignal.aborted) && !(abortSignal === null || abortSignal === void 0 ? void 0 : abortSignal.aborted)) {
+            throw TIMEOUT;
+        }
+        throw error;
+    }
+    if (timeoutAbortId != null) {
+        if (keepTimeoutUntilBodyRead) {
+            responseTimeouts.set(response, timeoutAbortId);
+        }
+        else {
+            clearTimeout(timeoutAbortId);
+        }
+    }
+    return response;
+});

package/dist/esm/core/fetcher/redactUrl.d.ts

@@ -0,0 +1,2 @@
+export declare const SENSITIVE_QUERY_PARAMS: Set<string>;
+export declare function redactUrl(url: string): string;

package/dist/esm/core/fetcher/redactUrl.js

@@ -0,0 +1,84 @@
+export const SENSITIVE_QUERY_PARAMS = new Set([
+    "api_key",
+    "api-key",
+    "apikey",
+    "token",
+    "access_token",
+    "access-token",
+    "auth_token",
+    "auth-token",
+    "password",
+    "passwd",
+    "secret",
+    "api_secret",
+    "api-secret",
+    "apisecret",
+    "key",
+    "session",
+    "session_id",
+    "session-id",
+]);
+export function redactUrl(url) {
+    const protocolIndex = url.indexOf("://");
+    if (protocolIndex === -1)
+        return url;
+    const afterProtocol = protocolIndex + 3;
+    // Find the first delimiter that marks the end of the authority section
+    const pathStart = url.indexOf("/", afterProtocol);
+    let queryStart = url.indexOf("?", afterProtocol);
+    let fragmentStart = url.indexOf("#", afterProtocol);
+    const firstDelimiter = Math.min(pathStart === -1 ? url.length : pathStart, queryStart === -1 ? url.length : queryStart, fragmentStart === -1 ? url.length : fragmentStart);
+    // Find the LAST @ before the delimiter (handles multiple @ in credentials)
+    let atIndex = -1;
+    for (let i = afterProtocol; i < firstDelimiter; i++) {
+        if (url[i] === "@") {
+            atIndex = i;
+        }
+    }
+    if (atIndex !== -1) {
+        url = `${url.slice(0, afterProtocol)}[REDACTED]@${url.slice(atIndex + 1)}`;
+    }
+    // Recalculate queryStart since url might have changed
+    queryStart = url.indexOf("?");
+    if (queryStart === -1)
+        return url;
+    fragmentStart = url.indexOf("#", queryStart);
+    const queryEnd = fragmentStart !== -1 ? fragmentStart : url.length;
+    const queryString = url.slice(queryStart + 1, queryEnd);
+    if (queryString.length === 0)
+        return url;
+    // FAST PATH: Quick check if any sensitive keywords present
+    // Using indexOf is faster than regex for simple substring matching
+    const lower = queryString.toLowerCase();
+    const hasSensitive = lower.includes("token") ||
+        lower.includes("key") ||
+        lower.includes("password") ||
+        lower.includes("passwd") ||
+        lower.includes("secret") ||
+        lower.includes("session") ||
+        lower.includes("auth");
+    if (!hasSensitive) {
+        return url;
+    }
+    // SLOW PATH: Parse and redact
+    const redactedParams = [];
+    const params = queryString.split("&");
+    for (const param of params) {
+        const equalIndex = param.indexOf("=");
+        if (equalIndex === -1) {
+            redactedParams.push(param);
+            continue;
+        }
+        const key = param.slice(0, equalIndex);
+        let shouldRedact = SENSITIVE_QUERY_PARAMS.has(key.toLowerCase());
+        if (!shouldRedact && key.includes("%")) {
+            try {
+                const decodedKey = decodeURIComponent(key);
+                shouldRedact = SENSITIVE_QUERY_PARAMS.has(decodedKey.toLowerCase());
+            }
+            catch (_a) { }
+        }
+        redactedParams.push(shouldRedact ? `${key}=[REDACTED]` : param);
+    }
+    return url.slice(0, queryStart + 1) + redactedParams.join("&") + url.slice(queryEnd);
+}

package/dist/esm/core/fetcher/requestWithRetries.d.ts

@@ -0,0 +1 @@
+export declare function requestWithRetries(requestFn: () => Promise<Response>, maxRetries?: number, abortSignal?: AbortSignal): Promise<Response>;

package/dist/esm/core/fetcher/requestWithRetries.js

@@ -0,0 +1,88 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+const INITIAL_RETRY_DELAY = 1000; // in milliseconds
+const MAX_RETRY_DELAY = 60000; // in milliseconds
+const DEFAULT_MAX_RETRIES = 2;
+const JITTER_FACTOR = 0.2; // 20% random jitter
+function isRetryableStatusCode(statusCode) {
+    return [408, 429].includes(statusCode) || statusCode >= 500;
+}
+function addPositiveJitter(delay) {
+    const jitterMultiplier = 1 + Math.random() * JITTER_FACTOR;
+    return delay * jitterMultiplier;
+}
+function addSymmetricJitter(delay) {
+    const jitterMultiplier = 1 + (Math.random() - 0.5) * JITTER_FACTOR;
+    return delay * jitterMultiplier;
+}
+function getRetryDelayFromHeaders(response, retryAttempt) {
+    const retryAfter = response.headers.get("Retry-After");
+    if (retryAfter) {
+        const retryAfterSeconds = parseInt(retryAfter, 10);
+        if (!Number.isNaN(retryAfterSeconds) && retryAfterSeconds > 0) {
+            return Math.min(retryAfterSeconds * 1000, MAX_RETRY_DELAY);
+        }
+        const retryAfterDate = new Date(retryAfter);
+        if (!Number.isNaN(retryAfterDate.getTime())) {
+            const delay = retryAfterDate.getTime() - Date.now();
+            if (delay > 0) {
+                return Math.min(Math.max(delay, 0), MAX_RETRY_DELAY);
+            }
+        }
+    }
+    const rateLimitReset = response.headers.get("X-RateLimit-Reset");
+    if (rateLimitReset) {
+        const resetTime = parseInt(rateLimitReset, 10);
+        if (!Number.isNaN(resetTime)) {
+            const delay = resetTime * 1000 - Date.now();
+            if (delay > 0) {
+                return addPositiveJitter(Math.min(delay, MAX_RETRY_DELAY));
+            }
+        }
+    }
+    return addSymmetricJitter(Math.min(INITIAL_RETRY_DELAY * Math.pow(2, retryAttempt), MAX_RETRY_DELAY));
+}
+/**
+ * Waits `ms` milliseconds, or rejects as soon as `abortSignal` aborts. The timer and
+ * the abort listener are always removed, so a cancelled wait never keeps the process alive.
+ */
+function sleep(ms, abortSignal) {
+    return new Promise((resolve, reject) => {
+        if (abortSignal === null || abortSignal === void 0 ? void 0 : abortSignal.aborted) {
+            reject(abortSignal.reason);
+            return;
+        }
+        const onAbort = () => {
+            clearTimeout(timeoutId);
+            reject(abortSignal === null || abortSignal === void 0 ? void 0 : abortSignal.reason);
+        };
+        const timeoutId = setTimeout(() => {
+            abortSignal === null || abortSignal === void 0 ? void 0 : abortSignal.removeEventListener("abort", onAbort);
+            resolve();
+        }, ms);
+        abortSignal === null || abortSignal === void 0 ? void 0 : abortSignal.addEventListener("abort", onAbort, { once: true });
+    });
+}
+export function requestWithRetries(requestFn_1) {
+    return __awaiter(this, arguments, void 0, function* (requestFn, maxRetries = DEFAULT_MAX_RETRIES, abortSignal) {
+        let response = yield requestFn();
+        for (let i = 0; i < maxRetries; ++i) {
+            if (isRetryableStatusCode(response.status)) {
+                const delay = getRetryDelayFromHeaders(response, i);
+                yield sleep(delay, abortSignal);
+                response = yield requestFn();
+            }
+            else {
+                break;
+            }
+        }
+        return response;
+    });
+}

package/dist/esm/core/fetcher/signals.d.ts

@@ -0,0 +1,6 @@
+export declare const TIMEOUT = "timeout";
+export declare function getTimeoutSignal(timeoutMs: number): {
+    signal: AbortSignal;
+    abortId: ReturnType<typeof setTimeout>;
+};
+export declare function anySignal(...args: AbortSignal[] | [AbortSignal[]]): AbortSignal;

package/dist/esm/core/fetcher/signals.js

@@ -0,0 +1,28 @@
+export const TIMEOUT = "timeout";
+export function getTimeoutSignal(timeoutMs) {
+    const controller = new AbortController();
+    const abortId = setTimeout(() => controller.abort(TIMEOUT), timeoutMs);
+    return { signal: controller.signal, abortId };
+}
+export function anySignal(...args) {
+    const signals = (args.length === 1 && Array.isArray(args[0]) ? args[0] : args);
+    const controller = new AbortController();
+    for (const signal of signals) {
+        if (signal.aborted) {
+            controller.abort(signal === null || signal === void 0 ? void 0 : signal.reason);
+            return controller.signal;
+        }
+        signal.addEventListener("abort", () => controller.abort(signal === null || signal === void 0 ? void 0 : signal.reason), {
+            signal: controller.signal,
+        });
+        // Re-check after adding listener: the signal may have aborted
+        // between the initial `signal.aborted` check and the `addEventListener`
+        // call above. If it did, the abort event was already dispatched and
+        // the listener will never fire — we must manually abort.
+        if (signal.aborted) {
+            controller.abort(signal === null || signal === void 0 ? void 0 : signal.reason);
+            return controller.signal;
+        }
+    }
+    return controller.signal;
+}

package/dist/esm/core/file/exports.d.ts

@@ -0,0 +1 @@
+export type { Uploadable } from "./types.js";

package/dist/esm/core/file/exports.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/core/file/file.d.ts

@@ -0,0 +1,10 @@
+import type { Uploadable } from "./types.js";
+export declare function toBinaryUploadRequest(file: Uploadable): Promise<{
+    body: Uploadable.FileLike;
+    headers?: Record<string, string>;
+}>;
+export declare function toMultipartDataPart(file: Uploadable): Promise<{
+    data: Uploadable.FileLike;
+    filename?: string;
+    contentType?: string;
+}>;