@zackbart/connecta 0.34.0 → 0.35.0

package/dist/provider-call-facts.js

@@ -0,0 +1,182 @@
+// Pure physical-request facts, failure provenance and construction identities.
+// No operation/call services or transport graph: provider definitions and
+// operator sinks can preserve provenance without acquiring Effect.
+import { carryResendAdvice, ConnectorCallError } from "./errors.js";
+import { followRedactedCopies } from "./redaction-identity.js";
+// A redacted copy of a failure is the same failure: its verdict follows it.
+const refusals = followRedactedCopies(new WeakMap());
+const knownFailures = followRedactedCopies(new WeakSet());
+// Verdicts that already account for a write's 401 in words of their own: a
+// renewal's (`unsentAfterUnauthorized`) or Q8's own. Q8 adds no sentence to them.
+const explainedUnauthorized = followRedactedCopies(new WeakSet());
+// Verdicts the one Q8 decision (`settleWrite`) made. They are final: nothing
+// after it may add retry, resend, key-reuse or wait advice to them.
+const settledWrites = followRedactedCopies(new WeakSet());
+// The authorization verdict a request's own 401 was mapped to, kept for the
+// call's verdict whatever failure surfaces after it (Q8).
+const unauthorizedAnswers = new WeakMap();
+const trackedConnectors = new WeakSet();
+const boundaries = new WeakMap();
+const delegators = new WeakMap();
+const aliases = new WeakMap();
+export function originalCallIdentity(connector) {
+    return aliases.get(connector) ?? connector;
+}
+export function boundaryFor(connector) {
+    return boundaries.get(connector);
+}
+export function delegatorFor(connector) {
+    return delegators.get(connector);
+}
+/** A physical send owns its fields permanently; its own answer is recorded once. */
+export function recordRequestField(request, field, value) {
+    Object.defineProperty(request, field, { value, enumerable: true, writable: false, configurable: false });
+}
+export function recordProviderResponse(request, status) {
+    if (request.status !== undefined)
+        throw new Error("Provider request already answered.");
+    recordRequestField(request, "status", status);
+}
+/**
+ * Declare that every request the connector's handlers send goes through a
+ * channel the call ledger records: a guarded transport, `ctx.fetch`, or
+ * `ctx.oauth.fetch`. Only then does an empty ledger prove that a failed
+ * write never left. Maintained providers declare it; an arbitrary `api()`
+ * handler can reach the network some other way, so its ledger proves nothing.
+ */
+export function tracksEveryRequest(connector) {
+    trackedConnectors.add(connector);
+    return connector;
+}
+export function tracksRequests(connector) {
+    return trackedConnectors.has(connector);
+}
+/**
+ * Declare a maintained connector whose `callTool` hands each call to at most
+ * one api() or remoteMcp() boundary and sends nothing else that could apply
+ * it (GitHub). Only then may that boundary's verdict stand for the call. The
+ * object and its function are recorded now, at construction: a later
+ * assignment to the property, or a copy of the object, declares nothing.
+ */
+export function delegatesEachCall(connector) {
+    delegators.set(connector, connector.callTool);
+    return connector;
+}
+/**
+ * Record a just-built api() or remoteMcp() object as a boundary, with its
+ * published `callTool`. Its own code then names the same object, from its
+ * closure, in {@link enterProviderBoundary}.
+ */
+export function providerBoundary(connector) {
+    boundaries.set(connector, { boundary: connector, own: connector.callTool });
+}
+/**
+ * `alias` serves `base` itself (`defineProvider`'s inheriting stamp), so it
+ * takes `base`'s recorded identities. Only construction code calls this.
+ */
+export function aliasCallIdentity(alias, base) {
+    aliases.set(alias, originalCallIdentity(base));
+    const boundary = boundaries.get(base);
+    const delegator = delegators.get(base);
+    if (boundary)
+        boundaries.set(alias, boundary);
+    if (delegator)
+        delegators.set(alias, delegator);
+}
+/**
+ * Whether a served HTTP status says the request was refused, not applied: a
+ * 4xx other than 408. A 408 is a timeout, whose request may have been acted
+ * on; a 2xx or 5xx never proves a write unapplied. A 401 passes here, and
+ * `servedRefusal` still asks for the vendor's reviewed evidence.
+ */
+export function refusedStatus(status) {
+    return status !== undefined && status >= 400 && status < 500 && status !== 408;
+}
+/**
+ * Refusal provenance, recorded where the answer is observed: the request was
+ * served a refusing status (`refusedStatus`) and the mapper failed on it. An
+ * error code alone is never this evidence.
+ */
+export function vendorRefusal(error, request) {
+    if (error !== null && typeof error === "object" && refusedStatus(request.status)) {
+        refusals.set(error, request);
+        if (request.status === 401 && authorizationFailure(error) && !unauthorizedAnswers.has(request))
+            unauthorizedAnswers.set(request, error);
+    }
+    return error;
+}
+/** An authorization verdict, the kind that keeps the `authorize_connector` handoff. */
+export function authorizationFailure(error) {
+    return (error instanceof ConnectorCallError &&
+        (error.code === "auth_required" || error.code === "downstream_oauth_required"));
+}
+/**
+ * The authorization verdict `request`'s own 401 answer was mapped to, as
+ * {@link vendorRefusal} recorded it. Undefined when nothing mapped that
+ * answer, such as a body past the ceiling.
+ */
+export function unauthorizedAnswer(request) {
+    return unauthorizedAnswers.get(request);
+}
+/**
+ * A renewal answered `request`'s own 401 (a refresh, a login, a fresh token
+ * minted) with `fresh`, a credential other than `sent`, the one the request
+ * carried: that 401 no longer needs the operator's recovery (Q8). It names
+ * the one request it answered and never marks another. A renewal that hands
+ * back the credential the request already sent (an earlier recovery reused)
+ * renewed nothing.
+ */
+export function renewedAfterUnauthorized(request, sent, fresh) {
+    if (request?.status === 401 && fresh !== sent && !request.renewed)
+        recordRequestField(request, "renewed", true);
+}
+export function refusalRequest(error) {
+    return error !== null && typeof error === "object" ? refusals.get(error) : undefined;
+}
+export function knownProviderFailure(error) {
+    if (error !== null && typeof error === "object")
+        knownFailures.add(error);
+    return error;
+}
+export function isKnownProviderFailure(error) {
+    return error !== null && typeof error === "object" && knownFailures.has(error);
+}
+/** Withdraw a verdict that does not hold for the call that reports it. */
+export function forgetProviderFailure(error) {
+    knownFailures.delete(error);
+    refusals.delete(error);
+}
+/** Preserve internal verdicts and resend advice through redaction and provider recovery wording. */
+export function carryProviderFailure(from, to) {
+    if (to !== null && typeof to === "object") {
+        const refusal = refusalRequest(from);
+        if (refusal)
+            refusals.set(to, refusal);
+        if (isKnownProviderFailure(from))
+            knownFailures.add(to);
+        if (explainsUnauthorized(from))
+            explainedUnauthorized.add(to);
+        if (isSettledWrite(from))
+            settledWrites.add(to);
+        carryResendAdvice(from, to);
+    }
+    return to;
+}
+/** Mark a verdict that already accounts for a write's 401 in its own words. */
+export function explainedUnauthorizedVerdict(error) {
+    if (error !== null && typeof error === "object")
+        explainedUnauthorized.add(error);
+    return error;
+}
+export function explainsUnauthorized(error) {
+    return error !== null && typeof error === "object" && explainedUnauthorized.has(error);
+}
+/** Mark a verdict the Q8 decision made, final for every step after it. */
+export function settledWrite(error) {
+    if (error !== null && typeof error === "object")
+        settledWrites.add(error);
+    return error;
+}
+export function isSettledWrite(error) {
+    return error !== null && typeof error === "object" && settledWrites.has(error);
+}

package/dist/provider-call.d.ts

@@ -0,0 +1,112 @@
+import { type ProviderRequest, type CallTool } from "./provider-call-facts.js";
+import type { ConnectorContext } from "./types.js";
+export interface ProviderCall {
+    requests: ProviderRequest[];
+    classification?: "read" | "write" | undefined;
+    /** The handler settled: its outcome may be reported, so nothing more leaves. */
+    closed: boolean;
+    /** The calls of api() boundaries entered beneath this one's handler. */
+    nested: ProviderCall[];
+    /** The call whose handler entered this one; undefined for the outermost. */
+    parent?: ProviderCall;
+}
+export interface LogicalCall {
+    target: object;
+    entered: CallTool;
+    boundaries: object[];
+    /** Every resource request dispatched under it, once per dispatch, from any ledger. */
+    sent: ProviderRequest[];
+    /** Auxiliary GET/HEAD dispatches without method overrides, apart from resource writes and auth POSTs. */
+    auxiliaryReads: ProviderRequest[];
+    /** A kit auxiliary declared as a read dispatched without physical read proof. */
+    nonReadAuxiliaryDispatched: boolean;
+}
+export declare function providerCallContext(ctx: ConnectorContext, classification?: "read" | "write"): ConnectorContext;
+/** Whether `ctx`'s call was entered by another api() boundary's handler. */
+export declare function nestedProviderCall(ctx: ConnectorContext): boolean;
+export declare function providerRequests(ctx: ConnectorContext): readonly ProviderRequest[] | undefined;
+/**
+ * Every request the ledgers of api() boundaries nested beneath `ctx`'s call
+ * recorded, at any depth: an inner call's 401 still decides the outer's
+ * write (Q8), whatever the outer handler made of the inner's failure.
+ */
+export declare function nestedProviderRequests(ctx: ConnectorContext): ProviderRequest[];
+/**
+ * End the call's ledger before its outcome is decided. A request still in
+ * flight already counts as dispatched; one that has not left yet (a sibling
+ * still reading its credential, say) is refused by {@link dispatchProviderRequest}
+ * and never leaves after the failure is reported.
+ */
+export declare function closeProviderCall(ctx: ConnectorContext): void;
+/**
+ * Refuse every request after its request scope ends, before credential reads
+ * and again immediately before dispatch. Resource requests also require an
+ * open call. Auxiliary requests (token mints, lookups) may outlive that call,
+ * but never their request.
+ */
+export declare function assertProviderCallOpen(ctx: ConnectorContext, provider: string, auxiliary: boolean): void;
+/** Record that a request leaves now; synchronous with the send that follows it. */
+export declare function dispatchProviderRequest(ctx: ConnectorContext | undefined, request: ProviderRequest, headers?: HeadersInit, method?: string | undefined): void;
+export declare function recordingFetch<T extends object>(send: T): T;
+export declare function isRecordingFetch(send: object | undefined): boolean;
+export declare function handoffProviderRequest(init: RequestInit, request: ProviderRequest): void;
+export declare function takeProviderHandoff(init: RequestInit): ProviderRequest | undefined;
+export declare function bindProviderResponse(response: object, request: ProviderRequest, owner: ProviderRequest | undefined): void;
+export declare function responseProviderRequest(response: object, owner: ProviderRequest): ProviderRequest | undefined;
+export declare function providerRequest(ctx: ConnectorContext, auxiliary: boolean, provider: string, sent?: {
+    method?: string;
+    key?: string;
+    classification?: "read" | "write";
+}): ProviderRequest;
+/**
+ * The invocation opens one logical call on the context it hands a connector,
+ * naming the exact object and `callTool` function it is about to invoke.
+ */
+export declare function openLogicalCall(ctx: ConnectorContext, target: object, entered: CallTool): LogicalCall;
+/**
+ * An api() or remoteMcp() boundary was entered under `ctx`'s logical call.
+ * `boundary` is the object it was built as, from its own closure, never `this`.
+ */
+export declare function enterProviderBoundary(ctx: ConnectorContext, boundary: object): void;
+/**
+ * Whether a failure's known mark holds for its whole logical call (INV-9).
+ * A boundary marks a write known only when every request it dispatched is
+ * proven unapplied, so the mark stands when that boundary owned the call
+ * ({@link ownsLogicalCall}) and at most one boundary was entered. A wrapper
+ * that composed several calls, or could send around them, never inherits an
+ * inner verdict.
+ */
+export declare function knownCallFailure(call: LogicalCall | undefined, error: unknown): boolean;
+/**
+ * Positive proof that a complete tracked call dispatched only auxiliaries,
+ * including a recorded resource read (positive GET/HEAD evidence). An
+ * authentication POST alone is not evidence of that call's resource work:
+ * token mints can be shared with callers whose ledgers did not send them.
+ * An empty resource ledger is not this proof: even a declared api() entry
+ * can report a timeout and recovery facts without recording any dispatch.
+ * Keep those calls conservative rather than inferring an auxiliary failure
+ * from the absence of a resource request. Wrappers and untracked boundaries
+ * cannot borrow an inner call's observations.
+ */
+export declare function onlyAuxiliaryRequests(call: LogicalCall | undefined): boolean;
+/**
+ * Whether reusing `key` with the exact original arguments cannot repeat any
+ * write of `ctx`'s logical call, the one basis for key-reuse advice (INV-9).
+ * It holds only when the call entered exactly one boundary, which owned it
+ * and tracks every request, and sent exactly one write, carrying `key`. A
+ * request counts as a read only with positive classification and a recorded
+ * GET or HEAD ({@link readRequest}). An inner request's key never speaks for a composite,
+ * a wrapper, a second write, or an earlier unrelated request.
+ */
+export declare function keyProtectsCall(call: LogicalCall | undefined, key: string | undefined): boolean;
+/** Positive read evidence, with GET/HEAD as #902's additional conservative bound. */
+export declare function readRequest(request: Pick<ProviderRequest, "classification" | "method">, headers?: HeadersInit): boolean;
+export declare function providerFetch(ctx: ConnectorContext, provider: string, auxiliary: boolean, send: typeof fetch): typeof fetch;
+/** Whether an invocation opened the logical call `ctx` belongs to; it then settles Q8 itself. */
+export declare function inLogicalCall(ctx: object): boolean;
+/**
+ * Every resource request dispatched under `ctx`'s logical call, from any
+ * ledger, nested ones included; undefined outside one.
+ */
+export declare function logicalCallRequests(ctx: object | undefined): readonly ProviderRequest[] | undefined;
+export { recordProviderResponse, tracksEveryRequest, tracksRequests, delegatesEachCall, providerBoundary, refusedStatus, vendorRefusal, authorizationFailure, unauthorizedAnswer, renewedAfterUnauthorized, refusalRequest, knownProviderFailure, isKnownProviderFailure, forgetProviderFailure, explainedUnauthorizedVerdict, explainsUnauthorized, settledWrite, isSettledWrite, type ProviderRequest, } from "./provider-call-facts.js";

package/dist/provider-call.js

@@ -0,0 +1,271 @@
+import { boundaryFor, delegatorFor, recordRequestField, recordProviderResponse, tracksRequests, isKnownProviderFailure, } from "./provider-call-facts.js";
+// One API call's request ledger in call services, and private failure
+// provenance. Each api() entry installs fresh services even if a direct caller
+// reuses its context concurrently. No request facts escape into agent or
+// operator records.
+import { Classification, ProviderLedger, LogicalLedger, recordedService, requestClosed, viewClosed, setViewService, callFromContext, contextView, viewLease, settleOnClose, } from "./runtime/call.js";
+import { callClassification } from "./call-classification.js";
+import { ConnectorCallError } from "./errors.js";
+export function providerCallContext(ctx, classification) {
+    const parent = recordedService(ctx, ProviderLedger);
+    const call = { requests: [], classification, closed: false, nested: [], ...(parent ? { parent } : {}) };
+    parent?.nested.push(call);
+    let view;
+    const lease = callFromContext(ctx, classification ?? callClassification(ctx) ?? "write", {
+        providerLedger: call,
+        ledger: {
+            open: ({ auxiliary, provider, method, key }) => providerRequest(view, auxiliary, provider, { method, ...(key === undefined ? {} : { key }) }),
+            dispatch: (request, headers, method) => dispatchProviderRequest(view, request, headers, method),
+        },
+    });
+    view = contextView(lease, ctx);
+    return view;
+}
+/** Whether `ctx`'s call was entered by another api() boundary's handler. */
+export function nestedProviderCall(ctx) {
+    return recordedService(ctx, ProviderLedger)?.parent !== undefined;
+}
+export function providerRequests(ctx) {
+    return recordedService(ctx, ProviderLedger)?.requests;
+}
+/**
+ * Every request the ledgers of api() boundaries nested beneath `ctx`'s call
+ * recorded, at any depth: an inner call's 401 still decides the outer's
+ * write (Q8), whatever the outer handler made of the inner's failure.
+ */
+export function nestedProviderRequests(ctx) {
+    const found = [];
+    const visit = (call) => {
+        for (const inner of call.nested) {
+            found.push(...inner.requests);
+            visit(inner);
+        }
+    };
+    const call = recordedService(ctx, ProviderLedger);
+    if (call)
+        visit(call);
+    return found;
+}
+/**
+ * End the call's ledger before its outcome is decided. A request still in
+ * flight already counts as dispatched; one that has not left yet (a sibling
+ * still reading its credential, say) is refused by {@link dispatchProviderRequest}
+ * and never leaves after the failure is reported.
+ */
+export function closeProviderCall(ctx) {
+    const call = recordedService(ctx, ProviderLedger);
+    if (call) {
+        const close = (current) => {
+            current.closed = true;
+            for (const child of current.nested)
+                close(child);
+        };
+        close(call);
+    }
+    viewLease(ctx)?.close();
+}
+/**
+ * Refuse every request after its request scope ends, before credential reads
+ * and again immediately before dispatch. Resource requests also require an
+ * open call. Auxiliary requests (token mints, lookups) may outlive that call,
+ * but never their request.
+ */
+export function assertProviderCallOpen(ctx, provider, auxiliary) {
+    if (requestClosed(ctx))
+        throw new ConnectorCallError("connector_call_failed", `This ${provider} request belongs to a request that has already ended, so it was not sent.`, { retryable: false });
+    if (auxiliary || (recordedService(ctx, ProviderLedger)?.closed !== true && !viewClosed(ctx)))
+        return;
+    throw new ConnectorCallError("connector_call_failed", `This ${provider} request belongs to a call that has already ended, so it was not sent.`, { retryable: false });
+}
+/** Record that a request leaves now; synchronous with the send that follows it. */
+export function dispatchProviderRequest(ctx, request, headers, method = request.method) {
+    if (ctx)
+        assertProviderCallOpen(ctx, request.provider, request.auxiliary);
+    if (request.dispatched)
+        throw new Error("Provider request already dispatched.");
+    if (hasMethodOverride(headers))
+        request.classification = "write";
+    recordRequestField(request, "method", method);
+    recordRequestField(request, "dispatched", true);
+    const logical = ctx && recordedService(ctx, LogicalLedger);
+    if (logical) {
+        if (!request.auxiliary)
+            logical.sent.push(request);
+        // Auxiliary ownership is the provider's read declaration; the served
+        // classification may still be write. Bind method/header evidence now,
+        // so token POSTs and overridden GETs cannot supply this proof later.
+        else if (method !== undefined && readRequest({ classification: "read", method }, headers))
+            logical.auxiliaryReads.push(request);
+        else if (request.blocksAuxiliaryProof)
+            logical.nonReadAuxiliaryDispatched = true;
+    }
+}
+// Only a fetch that records physical sends may accept an unsent handoff.
+const recordingFetches = new WeakSet();
+export function recordingFetch(send) {
+    recordingFetches.add(send);
+    return send;
+}
+export function isRecordingFetch(send) {
+    return send !== undefined && recordingFetches.has(send);
+}
+const handoffs = new WeakMap();
+export function handoffProviderRequest(init, request) {
+    if (request.dispatched)
+        throw new Error("Provider request already dispatched.");
+    handoffs.set(init, request);
+}
+export function takeProviderHandoff(init) {
+    // Consume before any await: a read replay or another call cannot take it.
+    const request = handoffs.get(init);
+    handoffs.delete(init);
+    return request?.dispatched ? undefined : request;
+}
+// Observation only: a mapper must name the physical reply it actually received.
+const responseRequests = new WeakMap();
+export function bindProviderResponse(response, request, owner) {
+    if (owner)
+        responseRequests.set(response, { request, owner });
+}
+export function responseProviderRequest(response, owner) {
+    const answer = responseRequests.get(response);
+    return answer?.owner === owner ? answer.request : undefined;
+}
+/** Override presence invalidates read evidence, whatever value the header carries. */
+function hasMethodOverride(headers) {
+    const sent = new Headers(headers);
+    return ["x-http-method-override", "x-http-method", "x-method-override"].some((name) => sent.has(name));
+}
+export function providerRequest(ctx, auxiliary, provider, sent = {}) {
+    const request = {
+        dispatched: false,
+        auxiliary,
+        provider,
+        classification: recordedService(ctx, ProviderLedger)?.classification ??
+            recordedService(ctx, Classification) ??
+            callClassification(ctx),
+        ...sent,
+    };
+    recordedService(ctx, ProviderLedger)?.requests.push(request);
+    return request;
+}
+/**
+ * The invocation opens one logical call on the context it hands a connector,
+ * naming the exact object and `callTool` function it is about to invoke.
+ */
+export function openLogicalCall(ctx, target, entered) {
+    const call = {
+        target,
+        entered,
+        boundaries: [],
+        sent: [],
+        auxiliaryReads: [],
+        nonReadAuxiliaryDispatched: false,
+    };
+    setViewService(ctx, LogicalLedger, call);
+    return call;
+}
+/**
+ * An api() or remoteMcp() boundary was entered under `ctx`'s logical call.
+ * `boundary` is the object it was built as, from its own closure, never `this`.
+ */
+export function enterProviderBoundary(ctx, boundary) {
+    recordedService(ctx, LogicalLedger)?.boundaries.push(boundary);
+}
+/**
+ * Whether a failure's known mark holds for its whole logical call (INV-9).
+ * A boundary marks a write known only when every request it dispatched is
+ * proven unapplied, so the mark stands when that boundary owned the call
+ * ({@link ownsLogicalCall}) and at most one boundary was entered. A wrapper
+ * that composed several calls, or could send around them, never inherits an
+ * inner verdict.
+ */
+export function knownCallFailure(call, error) {
+    return call !== undefined && isKnownProviderFailure(error) && call.boundaries.length <= 1 && ownsLogicalCall(call);
+}
+/**
+ * Positive proof that a complete tracked call dispatched only auxiliaries,
+ * including a recorded resource read (positive GET/HEAD evidence). An
+ * authentication POST alone is not evidence of that call's resource work:
+ * token mints can be shared with callers whose ledgers did not send them.
+ * An empty resource ledger is not this proof: even a declared api() entry
+ * can report a timeout and recovery facts without recording any dispatch.
+ * Keep those calls conservative rather than inferring an auxiliary failure
+ * from the absence of a resource request. Wrappers and untracked boundaries
+ * cannot borrow an inner call's observations.
+ */
+export function onlyAuxiliaryRequests(call) {
+    const [boundary, ...others] = call?.boundaries ?? [];
+    return (call !== undefined &&
+        boundary !== undefined &&
+        others.length === 0 &&
+        tracksRequests(boundary) &&
+        ownsLogicalCall(call) &&
+        call.auxiliaryReads.some((request) => request.dispatched) &&
+        !call.nonReadAuxiliaryDispatched &&
+        !call.sent.some((request) => request.dispatched && !request.auxiliary));
+}
+/**
+ * Whether reusing `key` with the exact original arguments cannot repeat any
+ * write of `ctx`'s logical call, the one basis for key-reuse advice (INV-9).
+ * It holds only when the call entered exactly one boundary, which owned it
+ * and tracks every request, and sent exactly one write, carrying `key`. A
+ * request counts as a read only with positive classification and a recorded
+ * GET or HEAD ({@link readRequest}). An inner request's key never speaks for a composite,
+ * a wrapper, a second write, or an earlier unrelated request.
+ */
+export function keyProtectsCall(call, key) {
+    const [boundary, ...others] = call?.boundaries ?? [];
+    if (!call || key === undefined || boundary === undefined || others.length > 0 || !tracksRequests(boundary))
+        return false;
+    const writes = call.sent.filter((request) => !readRequest(request));
+    return ownsLogicalCall(call) && writes.length === 1 && writes[0]?.key === key;
+}
+/**
+ * The call's invoked object owns it: a boundary object invoked with the
+ * function recorded for it at construction, and that boundary was the one
+ * entered; or a declared delegator object, likewise. Only identities captured
+ * at construction, dispatch and entry decide it, so a wrapper that reassigns
+ * `callTool` mid-call, or a copy that shares a boundary's function, cannot
+ * borrow its standing.
+ */
+function ownsLogicalCall(call) {
+    const boundary = boundaryFor(call.target);
+    return ((boundary?.own === call.entered && boundary.boundary === call.boundaries[0]) ||
+        delegatorFor(call.target) === call.entered);
+}
+/** Positive read evidence, with GET/HEAD as #902's additional conservative bound. */
+export function readRequest(request, headers) {
+    const method = request.method?.toUpperCase();
+    return (request.classification === "read" &&
+        (method === "GET" || method === "HEAD") &&
+        (headers === undefined || !hasMethodOverride(headers)));
+}
+export function providerFetch(ctx, provider, auxiliary, send) {
+    return (input, init) => settleOnClose(ctx, async (signal) => {
+        const method = init?.method ?? (input instanceof Request ? input.method : "GET");
+        const request = providerRequest(ctx, auxiliary, provider, { method });
+        dispatchProviderRequest(ctx, request, init?.headers ?? (input instanceof Request ? input.headers : undefined));
+        const signals = [signal, init?.signal ?? (input instanceof Request ? input.signal : undefined)].filter((signal) => signal !== undefined && signal !== null);
+        const sent = signals.length ? { ...init, signal: AbortSignal.any(signals) } : init;
+        const response = await send(input, sent);
+        recordProviderResponse(request, response.status);
+        if (signal.aborted) {
+            void response.body?.cancel().catch(() => { });
+            throw signal.reason;
+        }
+        return response;
+    }, auxiliary);
+}
+/** Whether an invocation opened the logical call `ctx` belongs to; it then settles Q8 itself. */
+export function inLogicalCall(ctx) {
+    return recordedService(ctx, LogicalLedger) !== undefined;
+}
+/**
+ * Every resource request dispatched under `ctx`'s logical call, from any
+ * ledger, nested ones included; undefined outside one.
+ */
+export function logicalCallRequests(ctx) {
+    return ctx ? recordedService(ctx, LogicalLedger)?.sent : undefined;
+}
+export { recordProviderResponse, tracksEveryRequest, tracksRequests, delegatesEachCall, providerBoundary, refusedStatus, vendorRefusal, authorizationFailure, unauthorizedAnswer, renewedAfterUnauthorized, refusalRequest, knownProviderFailure, isKnownProviderFailure, forgetProviderFailure, explainedUnauthorizedVerdict, explainsUnauthorized, settledWrite, isSettledWrite, } from "./provider-call-facts.js";