anilink-api-wrapper 2.1.0 → 2.2.0

package/dist/AniLink.mjs

@@ -1,6 +1,6 @@
+import { randomInt, randomUUID, createHash } from 'node:crypto';
 import http from 'node:http';
 import https from 'node:https';
-import { randomInt } from 'node:crypto';
 import axios from 'axios';
 
 const AniLinkErrorCodes = {
@@ -23,14 +23,18 @@ class AniLinkError extends Error {
    * @param message - A safe message intended for application logs.
    * @param code - The stable code used to classify the failure.
    * @param rawAxiosError - The original Axios error when raw diagnostics are enabled.
+   * @param options - Additional error metadata such as the request correlation ID.
    */
-  constructor(message, code, rawAxiosError) {
+  constructor(message, code, rawAxiosError, options) {
     super(message, rawAxiosError instanceof Error ? { cause: rawAxiosError } : void 0);
     this.name = "AniLinkError";
     this.code = code;
     if (rawAxiosError !== void 0) {
       this.rawAxiosError = rawAxiosError;
     }
+    if (options?.requestId !== void 0) {
+      this.requestId = options.requestId;
+    }
     Object.setPrototypeOf(this, new.target.prototype);
   }
 }
@@ -45,16 +49,21 @@ class AniLinkApiError extends AniLinkError {
    * @param status - The HTTP status returned by AniList.
    * @param data - The response body returned by AniList.
    * @param rawAxiosError - The original Axios error when raw diagnostics are enabled.
-   * @param options - Additional error metadata such as rate-limit headers.
+   * @param options - Additional error metadata such as rate-limit headers and the response content type.
    */
   constructor(status, data, rawAxiosError, options) {
-    super(`API request failed with status ${status}.`, AniLinkErrorCodes.API, rawAxiosError);
+    super(`API request failed with status ${status}.`, AniLinkErrorCodes.API, rawAxiosError, {
+      requestId: options?.requestId
+    });
     this.name = "AniLinkApiError";
     this.status = status;
     this.data = data;
     if (options?.rateLimit !== void 0) {
       this.rateLimit = options.rateLimit;
     }
+    if (options?.contentType !== void 0) {
+      this.contentType = options.contentType;
+    }
   }
 }
 const extractUpstreamStatus = (errors) => {
@@ -80,9 +89,10 @@ class AniLinkGraphQLError extends AniLinkApiError {
    * @param errors - The upstream GraphQL errors; each entry should carry a `message`.
    * @param data - The partial `data` object returned alongside the errors, when any. Exposed as {@link AniLinkGraphQLError.partialData}.
    * @param rawAxiosError - The original Axios error when raw diagnostics are enabled.
+   * @param options - Additional error metadata such as rate-limit headers and the response content type. AniList returns rate-limit headers even on HTTP 200 envelopes carrying GraphQL errors (for example a GraphQL-level `429`), so threading them here keeps {@link AniLinkGraphQLError.rateLimit} consistent with the HTTP-failure path.
    */
-  constructor(errors, data, rawAxiosError) {
-    super(extractUpstreamStatus(errors) ?? 200, data, rawAxiosError);
+  constructor(errors, data, rawAxiosError, options) {
+    super(extractUpstreamStatus(errors) ?? 200, data, rawAxiosError, options);
     this.name = "AniLinkGraphQLError";
     this.code = AniLinkErrorCodes.GRAPHQL;
     this.message = `The request failed with GraphQL errors: ${errors.map((graphqlError) => graphqlError.message).join("; ")}`;
@@ -131,7 +141,7 @@ class AniLinkRestError extends AniLinkApiError {
    * @param status - The HTTP status returned by the upstream REST API.
    * @param data - The response body returned by the upstream REST API.
    * @param rawAxiosError - The original Axios error when raw diagnostics are enabled.
-   * @param options - Additional error metadata such as rate-limit headers.
+   * @param options - Additional error metadata such as rate-limit headers, the response content type, and the request correlation ID.
    */
   constructor(status, data, rawAxiosError, options) {
     super(status, data, rawAxiosError, options);
@@ -145,29 +155,24 @@ class AniLinkNetworkError extends AniLinkError {
    * @param code - The stable code for the transport failure.
    * @param message - A safe message intended for application logs.
    * @param rawAxiosError - The original Axios error when raw diagnostics are enabled.
-   * @param options - Additional transport metadata such as the effective timeout duration.
+   * @param options - Additional transport metadata such as the effective timeout duration and the request correlation ID.
    */
   constructor(code, message, rawAxiosError, options) {
-    super(message, code, rawAxiosError);
+    super(message, code, rawAxiosError, { requestId: options?.requestId });
     this.name = "AniLinkNetworkError";
     if (options?.timeoutMs !== void 0) {
       this.timeoutMs = options.timeoutMs;
     }
+    if (options?.abortedDuringPacing !== void 0) {
+      this.abortedDuringPacing = options.abortedDuringPacing;
+    }
   }
 }
 
 const DEFAULT_REQUEST_TIMEOUT = 3e4;
-const MAX_RETRY_AFTER_MS = 6e4;
 const MAX_FREE_SOCKETS = 5;
 const MAX_SOCKETS = 20;
-const DEFAULT_RETRY_POLICY = {
-  maxRetries: 3,
-  baseDelayMs: 250,
-  maxDelayMs: 5e3,
-  retryOnStatus: [429, 500, 502, 503, 504],
-  retryOnNetworkError: true,
-  jitter: true
-};
+
 const defaultHttpAgent = new http.Agent({
   keepAlive: true,
   maxSockets: MAX_SOCKETS,
@@ -185,32 +190,176 @@ const axiosClient = axios.create({
   httpAgent: defaultHttpAgent,
   httpsAgent: defaultHttpsAgent
 });
-const resolveRetryPolicy = (retry) => {
-  if (retry === false) {
-    return null;
+const MAX_CACHED_AGENT_PAIRS = 8;
+const cachedAgentPairs = /* @__PURE__ */ new Map();
+const parkedEvictedPairs = [];
+const buildAgentCacheKey = (maxSockets, maxFreeSockets) => `${maxSockets}:${maxFreeSockets}`;
+const evictLruAgentPair = () => {
+  const oldestKey = cachedAgentPairs.keys().next().value;
+  if (oldestKey !== void 0) {
+    const evicted = cachedAgentPairs.get(oldestKey);
+    cachedAgentPairs.delete(oldestKey);
+    if (evicted !== void 0) {
+      parkedEvictedPairs.push(evicted);
+    }
   }
-  if (retry === void 0 || retry === true) {
-    return { ...DEFAULT_RETRY_POLICY };
+};
+const destroyCachedAgents = () => {
+  for (const pair of cachedAgentPairs.values()) {
+    pair.httpAgent.destroy();
+    pair.httpsAgent.destroy();
   }
-  return { ...DEFAULT_RETRY_POLICY, ...retry };
+  cachedAgentPairs.clear();
+  for (const pair of parkedEvictedPairs) {
+    pair.httpAgent.destroy();
+    pair.httpsAgent.destroy();
+  }
+  parkedEvictedPairs.length = 0;
 };
 const resolveAgents = (maxSockets, maxFreeSockets) => {
   if (maxSockets === void 0 && maxFreeSockets === void 0) {
     return { httpAgent: defaultHttpAgent, httpsAgent: defaultHttpsAgent };
   }
-  const sockets = Math.max(1, maxSockets ?? MAX_SOCKETS);
-  const freeSockets = Math.max(0, maxFreeSockets ?? MAX_FREE_SOCKETS);
+  const normalizeSockets = (value, fallback, min) => {
+    if (value === void 0 || !Number.isFinite(value) || !Number.isInteger(value)) {
+      return Math.max(min, fallback);
+    }
+    return Math.max(min, value);
+  };
+  const sockets = normalizeSockets(maxSockets, MAX_SOCKETS, 1);
+  const freeSockets = normalizeSockets(maxFreeSockets, MAX_FREE_SOCKETS, 0);
+  const key = buildAgentCacheKey(sockets, freeSockets);
+  const cached = cachedAgentPairs.get(key);
+  if (cached !== void 0) {
+    cachedAgentPairs.delete(key);
+    cachedAgentPairs.set(key, cached);
+    return { httpAgent: cached.httpAgent, httpsAgent: cached.httpsAgent };
+  }
+  if (cachedAgentPairs.size >= MAX_CACHED_AGENT_PAIRS) {
+    evictLruAgentPair();
+  }
   const agentOptions = {
     keepAlive: true,
     maxSockets: sockets,
     maxFreeSockets: freeSockets,
     scheduling: "lifo"
   };
-  return {
+  const pair = {
     httpAgent: new http.Agent(agentOptions),
     httpsAgent: new https.Agent(agentOptions)
   };
+  cachedAgentPairs.set(key, pair);
+  return { httpAgent: pair.httpAgent, httpsAgent: pair.httpsAgent };
 };
+
+const MAX_RETRY_AFTER_MS = 6e4;
+const DEFAULT_RETRY_POLICY = {
+  maxRetries: 3,
+  baseDelayMs: 250,
+  maxDelayMs: 5e3,
+  retryOnStatus: [429, 500, 502, 503, 504],
+  retryOnNetworkError: true,
+  jitter: true
+};
+const resolveRetryPolicy = (retry) => {
+  if (retry === false) {
+    return null;
+  }
+  if (retry === void 0 || retry === true) {
+    return { ...DEFAULT_RETRY_POLICY };
+  }
+  const filtered = {};
+  for (const [key, value] of Object.entries(retry)) {
+    if (value !== void 0) {
+      filtered[key] = value;
+    }
+  }
+  return { ...DEFAULT_RETRY_POLICY, ...filtered };
+};
+const parseRetryAfter = (header, now) => {
+  if (header === void 0 || header === null || header === "") {
+    return null;
+  }
+  const seconds = Number(header);
+  if (Number.isFinite(seconds) && seconds >= 0) {
+    return Math.min(seconds * 1e3, MAX_RETRY_AFTER_MS);
+  }
+  const date = Date.parse(header);
+  if (Number.isFinite(date)) {
+    return Math.max(0, Math.min(date - now, MAX_RETRY_AFTER_MS));
+  }
+  return null;
+};
+const getRetryAfterDelay = (error) => {
+  if (axios.isAxiosError(error)) {
+    const header = error.response?.headers?.["retry-after"];
+    if (typeof header === "string" || header === void 0) {
+      return parseRetryAfter(header, Date.now());
+    }
+  }
+  return null;
+};
+const getBackoffDelay = (attempt, policy) => Math.min(policy.baseDelayMs * 2 ** attempt, policy.maxDelayMs);
+const applyJitter = (cap, policy) => policy.jitter === false ? cap : randomInt(0, cap + 1);
+const getRetryDelay = (error, rawError, attempt, policy) => {
+  if (attempt >= policy.maxRetries) {
+    return null;
+  }
+  if (error instanceof AniLinkGraphQLError) {
+    if (error.status === 429) {
+      return getRetryAfterDelay(rawError) ?? applyJitter(getBackoffDelay(attempt, policy), policy);
+    }
+    if (policy.retryOnStatus.includes(error.status)) {
+      return applyJitter(getBackoffDelay(attempt, policy), policy);
+    }
+    return null;
+  }
+  if (error instanceof AniLinkApiError) {
+    if (error.status === 429) {
+      return getRetryAfterDelay(rawError) ?? applyJitter(getBackoffDelay(attempt, policy), policy);
+    }
+    if (policy.retryOnStatus.includes(error.status)) {
+      return applyJitter(getBackoffDelay(attempt, policy), policy);
+    }
+    return null;
+  }
+  if (error instanceof AniLinkNetworkError) {
+    if (error.code === AniLinkErrorCodes.ABORTED) {
+      return null;
+    }
+    if (policy.retryOnNetworkError) {
+      return applyJitter(getBackoffDelay(attempt, policy), policy);
+    }
+  }
+  return null;
+};
+const computeNextRetryDelay = (input) => {
+  const { normalized, rawError, attempt, policy, budgetState, budget, wasProbe } = input;
+  if (wasProbe || policy === null) {
+    return null;
+  }
+  if (budgetState !== void 0 && budget !== void 0 && budgetState.retriesUsed >= budget.maxRetriesPerWindow) {
+    return null;
+  }
+  return getRetryDelay(normalized, rawError, attempt, policy);
+};
+const retryBudgetStates = /* @__PURE__ */ new WeakMap();
+const getRetryBudgetState = (owner, budget) => {
+  if (owner === void 0 || budget === void 0) {
+    return void 0;
+  }
+  let state = retryBudgetStates.get(owner);
+  if (state === void 0) {
+    state = { retriesUsed: 0, windowEndsAt: 0 };
+    retryBudgetStates.set(owner, state);
+  }
+  if (Date.now() >= state.windowEndsAt) {
+    state.retriesUsed = 0;
+    state.windowEndsAt = Date.now() + budget.windowMs;
+  }
+  return state;
+};
+
 const resolveRequestOptions = (options = {}) => {
   const timeout = options.timeout ?? DEFAULT_REQUEST_TIMEOUT;
   if (!Number.isFinite(timeout) || timeout < 0) {
@@ -231,29 +380,78 @@ const resolveRequestOptions = (options = {}) => {
     onError: options.onError,
     onRetry: options.onRetry,
     onRequestStart: options.onRequestStart,
-    onResponse: options.onResponse
+    onResponse: options.onResponse,
+    onPace: options.onPace,
+    onHookError: options.onHookError,
+    onCircuitOpen: options.onCircuitOpen,
+    onCircuitClose: options.onCircuitClose,
+    ignorePaceDeadline: options.ignorePaceDeadline ?? false,
+    responseCache: options.responseCache
   };
 };
-const unwrapSingleRootField = (response) => {
-  const envelope = response;
-  const queryData = envelope?.data;
-  if (!queryData || typeof queryData !== "object") {
-    return void 0;
+
+const SENSITIVE_HEADER_KEYS = /^(authorization|cookie|set-cookie|proxy-authorization|proxy-auth|authentication|(x-)?api[-_]?key|(x-)?auth[-_]?token|(x-)?session(-id)?|session)$/i;
+const redactAxiosError = (error) => {
+  const config = error.config;
+  const response = error.response;
+  const isHeaderMap = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+  const configNeedsRedaction = config !== void 0 && (isHeaderMap(config.headers) || config.data !== void 0 || config.auth !== void 0);
+  const responseNeedsRedaction = response !== void 0 && (response.config !== void 0 || isHeaderMap(response.headers) || response.request !== void 0);
+  const requestNeedsRedaction = error.request !== void 0;
+  if (!configNeedsRedaction && !responseNeedsRedaction && !requestNeedsRedaction) {
+    return error;
   }
-  const fields = Object.keys(queryData);
-  if (fields.length === 1) {
-    return queryData[fields[0]];
+  const redactHeaders = (headers) => {
+    const scrubbed = {};
+    for (const [key, value] of Object.entries(headers)) {
+      if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+        scrubbed[key] = redactHeaders(value);
+      } else {
+        scrubbed[key] = SENSITIVE_HEADER_KEYS.test(key) ? "[REDACTED]" : value;
+      }
+    }
+    return scrubbed;
+  };
+  const redactConfig = (source) => {
+    const cloned2 = { ...source };
+    const headers = source.headers;
+    if (isHeaderMap(headers)) {
+      cloned2.headers = redactHeaders(headers);
+    }
+    if (source.data !== void 0) {
+      cloned2.data = "[REDACTED]";
+    }
+    if (source.auth !== void 0) {
+      cloned2.auth = "[REDACTED]";
+    }
+    return cloned2;
+  };
+  const cloned = { ...error };
+  const clonedRecord = cloned;
+  if (requestNeedsRedaction) {
+    clonedRecord.request = "[REDACTED]";
   }
-  return void 0;
-};
-const unwrapGraphQLResponse = (response) => {
-  const envelope = response;
-  if (Array.isArray(envelope?.errors) && envelope.errors.length > 0) {
-    throw new AniLinkGraphQLError(envelope.errors, envelope?.data);
+  if (config !== void 0) {
+    clonedRecord.config = redactConfig(config);
   }
-  return unwrapSingleRootField(response) ?? response;
+  if (response !== void 0) {
+    const clonedResponse = { ...response };
+    const responseConfig = response.config;
+    if (responseConfig !== void 0) {
+      clonedResponse.config = redactConfig(responseConfig);
+    }
+    const responseHeaders = response.headers;
+    if (isHeaderMap(responseHeaders)) {
+      clonedResponse.headers = redactHeaders(responseHeaders);
+    }
+    if (response.request !== void 0) {
+      clonedResponse.request = "[REDACTED]";
+    }
+    clonedRecord.response = clonedResponse;
+  }
+  return cloned;
 };
-const getRawAxiosError = (resolved, error) => resolved.exposeRawAxiosError ? error : void 0;
+const getRawAxiosError = (resolved, error) => resolved.exposeRawAxiosError ? axios.isAxiosError(error) ? redactAxiosError(error) : error : void 0;
 const getRateLimitInfo = (headers) => {
   if (!headers) {
     return void 0;
@@ -266,19 +464,29 @@ const getRateLimitInfo = (headers) => {
   }
   return { limit, remaining, reset };
 };
-const normalizeAxiosError = (resolved, error, isRestCall = false) => {
+const getResponseContentType = (headers) => {
+  if (!headers) return void 0;
+  const raw = headers["content-type"] ?? headers["Content-Type"];
+  return typeof raw === "string" ? raw : void 0;
+};
+const normalizeAxiosError = (resolved, error, isRestCall = false, requestId) => {
   if (axios.isCancel(error)) {
     return new AniLinkNetworkError(
       AniLinkErrorCodes.ABORTED,
       "The request was cancelled.",
-      getRawAxiosError(resolved, error)
+      getRawAxiosError(resolved, error),
+      { requestId }
     );
   }
   if (error.response?.status !== void 0) {
     const status = error.response.status;
     const data = error.response.data;
     const rawAxiosError = getRawAxiosError(resolved, error);
-    const options = { rateLimit: getRateLimitInfo(error.response.headers) };
+    const options = {
+      rateLimit: getRateLimitInfo(error.response.headers),
+      contentType: getResponseContentType(error.response.headers),
+      requestId
+    };
     return isRestCall ? new AniLinkRestError(status, data, rawAxiosError, options) : new AniLinkApiError(status, data, rawAxiosError, options);
   }
   if (error.code === "ECONNABORTED" || error.code === "ETIMEDOUT") {
@@ -286,128 +494,133 @@ const normalizeAxiosError = (resolved, error, isRestCall = false) => {
       AniLinkErrorCodes.TIMEOUT,
       "The request timed out.",
       getRawAxiosError(resolved, error),
-      resolved.timeout > 0 ? { timeoutMs: resolved.timeout } : void 0
+      { timeoutMs: resolved.timeout > 0 ? resolved.timeout : void 0, requestId }
     );
   }
   return new AniLinkNetworkError(
     AniLinkErrorCodes.NETWORK,
     "The request failed due to a network error.",
-    getRawAxiosError(resolved, error)
+    getRawAxiosError(resolved, error),
+    { requestId }
   );
 };
-const normalizeRequestError = (resolved, error, isRestCall = false) => {
+const stampRequestId = (error, requestId) => {
+  if (requestId === void 0 || error.requestId !== void 0) {
+    return;
+  }
+  Object.defineProperty(error, "requestId", {
+    value: requestId,
+    writable: false,
+    enumerable: true,
+    configurable: false
+  });
+};
+const normalizeRequestError = (resolved, error, isRestCall = false, requestId) => {
   if (error instanceof AniLinkError) {
+    stampRequestId(error, requestId);
     return error;
   }
   if (axios.isAxiosError(error)) {
-    return normalizeAxiosError(resolved, error, isRestCall);
+    return normalizeAxiosError(resolved, error, isRestCall, requestId);
   }
   return new AniLinkError(
     "The request failed.",
     AniLinkErrorCodes.UNKNOWN,
-    getRawAxiosError(resolved, error)
+    getRawAxiosError(resolved, error),
+    { requestId }
   );
 };
-const parseRetryAfter = (header, now) => {
-  if (header === void 0 || header === null || header === "") {
-    return null;
-  }
-  const seconds = Number(header);
-  if (Number.isFinite(seconds) && seconds >= 0) {
-    return Math.min(seconds * 1e3, MAX_RETRY_AFTER_MS);
-  }
-  const date = Date.parse(header);
-  if (Number.isFinite(date)) {
-    return Math.max(0, Math.min(date - now, MAX_RETRY_AFTER_MS));
+
+const unwrapSingleRootField = (response) => {
+  const envelope = response;
+  const queryData = envelope?.data;
+  if (!queryData || typeof queryData !== "object") {
+    return void 0;
   }
-  return null;
-};
-const getRetryAfterDelay = (error) => {
-  if (axios.isAxiosError(error)) {
-    const header = error.response?.headers?.["retry-after"];
-    if (typeof header === "string" || header === void 0) {
-      return parseRetryAfter(header, Date.now());
-    }
+  const fields = Object.keys(queryData);
+  if (fields.length === 1) {
+    return queryData[fields[0]];
   }
-  return null;
+  return void 0;
 };
-const getBackoffDelay = (attempt, policy) => Math.min(policy.baseDelayMs * 2 ** attempt, policy.maxDelayMs);
-const applyJitter = (cap, policy) => policy.jitter === false ? cap : randomInt(0, cap + 1);
-const getRetryDelay = (error, rawError, attempt, policy) => {
-  if (attempt >= policy.maxRetries) {
-    return null;
-  }
-  if (error instanceof AniLinkApiError) {
-    if (error.status === 429) {
-      return getRetryAfterDelay(rawError) ?? applyJitter(getBackoffDelay(attempt, policy), policy);
-    }
-    if (policy.retryOnStatus.includes(error.status)) {
-      return applyJitter(getBackoffDelay(attempt, policy), policy);
-    }
-    return null;
-  }
-  if (error instanceof AniLinkNetworkError) {
-    if (error.code === AniLinkErrorCodes.ABORTED) {
-      return null;
-    }
-    if (policy.retryOnNetworkError) {
-      return applyJitter(getBackoffDelay(attempt, policy), policy);
-    }
+const unwrapGraphQLResponse = (response, headers) => {
+  const envelope = response;
+  if (Array.isArray(envelope?.errors) && envelope.errors.length > 0) {
+    throw new AniLinkGraphQLError(envelope.errors, envelope?.data, void 0, {
+      rateLimit: getRateLimitInfo(headers),
+      contentType: getResponseContentType(headers ?? {})
+    });
   }
-  return null;
+  const unwrapped = unwrapSingleRootField(response);
+  return unwrapped === void 0 ? response : unwrapped;
 };
-const sleep = (ms, signal) => new Promise((resolve, reject) => {
-  const timeout = setTimeout(() => {
-    signal?.removeEventListener("abort", abort);
-    resolve();
-  }, ms);
-  const abort = () => {
-    clearTimeout(timeout);
-    reject(
-      new AniLinkNetworkError(AniLinkErrorCodes.ABORTED, "The request was cancelled.")
-    );
-  };
-  if (signal?.aborted) {
-    abort();
-    return;
-  }
-  signal?.addEventListener("abort", abort, { once: true });
-});
-const safeInvoke = (hook, name, ...args) => {
+
+const safeInvoke = (hook, name, onHookError, ...args) => {
   if (hook === void 0) {
     return;
   }
   try {
     hook(...args);
   } catch (hookError) {
+    if (onHookError !== void 0) {
+      try {
+        onHookError(name, hookError);
+      } catch {
+      }
+      return;
+    }
+    const firstArg = args[0];
+    const requestId = firstArg !== null && typeof firstArg === "object" && "requestId" in firstArg && typeof firstArg.requestId === "string" ? firstArg.requestId : void 0;
+    const correlation = requestId === void 0 ? "" : ` (requestId: ${requestId})`;
     console.warn(
-      `[AniLink] ${name} hook threw and was ignored:`,
+      `[AniLink] ${name} hook threw and was ignored${correlation}:`,
       hookError instanceof Error ? hookError.message : hookError
     );
   }
 };
-const circuitStates = /* @__PURE__ */ new WeakMap();
-const retryBudgetStates = /* @__PURE__ */ new WeakMap();
-const getRetryBudgetState = (owner, budget) => {
-  if (owner === void 0 || budget === void 0) {
-    return void 0;
+const buildErrorContext = (requestId, url, method, attempt, normalized, nextDelayMs) => ({
+  requestId,
+  url,
+  method,
+  attempt,
+  code: normalized.code,
+  ...normalized instanceof AniLinkApiError ? { status: normalized.status } : {},
+  ...normalized instanceof AniLinkApiError && normalized.rateLimit !== void 0 ? { rateLimit: normalized.rateLimit } : {},
+  ...nextDelayMs === void 0 ? {} : { nextDelayMs }
+});
+const reportFailure = (requestId, url, method, attempt, normalized, resolved, nextDelayMs) => {
+  const context = buildErrorContext(requestId, url, method, attempt, normalized, nextDelayMs);
+  if (nextDelayMs !== void 0) {
+    safeInvoke(
+      resolved.onRetry ?? resolved.onError,
+      resolved.onRetry === void 0 ? "onError" : "onRetry",
+      resolved.onHookError,
+      normalized,
+      context
+    );
+    return;
   }
-  let state = retryBudgetStates.get(owner);
-  if (state === void 0) {
-    state = { retriesUsed: 0, windowEndsAt: 0 };
-    retryBudgetStates.set(owner, state);
+  safeInvoke(resolved.onError, "onError", resolved.onHookError, normalized, context);
+};
+
+const circuitStates = /* @__PURE__ */ new WeakMap();
+const isAvailabilityFailure = (error) => {
+  if (error instanceof AniLinkNetworkError) {
+    return error.code !== AniLinkErrorCodes.ABORTED;
   }
-  if (Date.now() >= state.windowEndsAt) {
-    state.retriesUsed = 0;
-    state.windowEndsAt = Date.now() + budget.windowMs;
+  if (error instanceof AniLinkApiError) {
+    return error.status === 429 || error.status >= 500;
   }
-  return state;
+  return false;
 };
-const circuitScopeOf = (url) => {
+const MAX_CIRCUIT_SCOPES_PER_OWNER = 64;
+const circuitScopeOf = (url, requestId) => {
   try {
     return new URL(url).host;
   } catch {
-    return "";
+    const error = new AniLinkValidationError(["Unparseable request URL"]);
+    stampRequestId(error, requestId);
+    throw error;
   }
 };
 const getCircuitState = (owner, scope) => {
@@ -417,67 +630,178 @@ const getCircuitState = (owner, scope) => {
     circuitStates.set(owner, scopes);
   }
   let state = scopes.get(scope);
-  if (state === void 0) {
-    state = { consecutiveFailures: 0, openedAt: null };
+  if (state !== void 0) {
+    scopes.delete(scope);
     scopes.set(scope, state);
+    return state;
   }
+  if (scopes.size >= MAX_CIRCUIT_SCOPES_PER_OWNER) {
+    const oldestScope = scopes.keys().next().value;
+    if (oldestScope !== void 0) {
+      scopes.delete(oldestScope);
+    }
+  }
+  state = {
+    consecutiveFailures: 0,
+    openedAt: null,
+    probeInFlight: false
+  };
+  scopes.set(scope, state);
   return state;
 };
-const throwIfCircuitOpen = (circuit, breaker) => {
-  if (circuit === void 0 || breaker === void 0 || circuit.openedAt === null) {
-    return;
+const checkCircuitOpen = (circuit, breaker) => {
+  if (circuit === void 0 || breaker === void 0) {
+    return void 0;
+  }
+  if (circuit.probeInFlight) {
+    return new AniLinkNetworkError(
+      AniLinkErrorCodes.CIRCUIT,
+      `The request failed fast: the circuit breaker is probing the upstream after ${breaker.threshold} consecutive failures. Retrying is possible once the probe settles.`
+    );
+  }
+  if (circuit.openedAt === null) {
+    return void 0;
   }
   if (Date.now() - circuit.openedAt < breaker.cooldownMs) {
-    throw new AniLinkNetworkError(
+    return new AniLinkNetworkError(
       AniLinkErrorCodes.CIRCUIT,
       `The request failed fast: the circuit breaker is open after ${breaker.threshold} consecutive failures. Retrying is possible after the cooldown elapses.`
     );
   }
   circuit.openedAt = null;
+  circuit.probeInFlight = true;
+  return void 0;
 };
-const recordCircuitSuccess = (circuit) => {
-  if (circuit !== void 0) {
-    circuit.consecutiveFailures = 0;
+const recordCircuitSuccess = (circuit, resolved, hookContext, host) => {
+  if (circuit === void 0) {
+    return;
+  }
+  const wasOpen = circuit.openedAt !== null || circuit.probeInFlight;
+  circuit.probeInFlight = false;
+  circuit.consecutiveFailures = 0;
+  circuit.openedAt = null;
+  if (wasOpen && resolved.onCircuitClose !== void 0) {
+    safeInvoke(resolved.onCircuitClose, "onCircuitClose", resolved.onHookError, {
+      ...hookContext,
+      host
+    });
   }
 };
-const recordCircuitFailure = (circuit, breaker) => {
+const recordCircuitFailure = (circuit, breaker, normalized, resolved, hookContext, host) => {
   if (circuit === void 0 || breaker === void 0) {
     return;
   }
+  if (!isAvailabilityFailure(normalized)) {
+    recordCircuitSuccess(circuit, resolved, hookContext, host);
+    return;
+  }
+  if (circuit.probeInFlight) {
+    circuit.probeInFlight = false;
+    circuit.openedAt = Date.now();
+    return;
+  }
   circuit.consecutiveFailures += 1;
-  if (circuit.consecutiveFailures >= breaker.threshold) {
+  if (circuit.consecutiveFailures >= breaker.threshold && circuit.openedAt === null) {
     circuit.openedAt = Date.now();
+    if (resolved.onCircuitOpen !== void 0) {
+      safeInvoke(resolved.onCircuitOpen, "onCircuitOpen", resolved.onHookError, {
+        ...hookContext,
+        host,
+        failures: circuit.consecutiveFailures
+      });
+    }
   }
 };
-const buildErrorContext = (url, method, attempt, normalized, nextDelayMs) => ({
-  url,
-  method,
-  attempt,
-  code: normalized.code,
-  ...normalized instanceof AniLinkApiError ? { status: normalized.status } : {},
-  ...nextDelayMs === void 0 ? {} : { nextDelayMs }
+
+const sleep = (ms, signal, requestId) => new Promise((resolve, reject) => {
+  const timeout = setTimeout(() => {
+    signal?.removeEventListener("abort", abort);
+    resolve();
+  }, ms);
+  timeout.unref();
+  const abort = () => {
+    clearTimeout(timeout);
+    const error = new AniLinkNetworkError(
+      AniLinkErrorCodes.ABORTED,
+      "The request was cancelled."
+    );
+    stampRequestId(error, requestId);
+    reject(error);
+  };
+  if (signal?.aborted) {
+    abort();
+    return;
+  }
+  signal?.addEventListener("abort", abort, { once: true });
 });
-const paceAfterSuccess = async (response, resolved) => {
-  if (!resolved.paceWithRateLimit) {
+
+const paceDeadlines = /* @__PURE__ */ new WeakMap();
+const MAX_PACE_WAIT_MS = 5 * 60 * 1e3;
+const sleepForPacing = async (delayMs, resolved, hookContext) => {
+  try {
+    await sleep(delayMs, resolved.signal, hookContext.requestId);
+  } catch (error) {
+    if (error instanceof AniLinkNetworkError && error.code === AniLinkErrorCodes.ABORTED && !axios.isCancel(error)) {
+      const pacingError = new AniLinkNetworkError(
+        AniLinkErrorCodes.ABORTED,
+        "The request was cancelled while waiting for the rate-limit window to reset.",
+        void 0,
+        { abortedDuringPacing: true }
+      );
+      stampRequestId(pacingError, hookContext.requestId);
+      throw pacingError;
+    }
+    throw error;
+  }
+};
+const recordPaceDeadline = (owner, host, deadlineMs) => {
+  let scopes = paceDeadlines.get(owner);
+  if (scopes === void 0) {
+    scopes = /* @__PURE__ */ new Map();
+    paceDeadlines.set(owner, scopes);
+  }
+  if (deadlineMs <= Date.now()) {
+    scopes.delete(host);
     return;
   }
-  const info = getRateLimitInfo(response.headers);
-  if (info !== void 0 && info.remaining < resolved.rateLimitFloor) {
-    await sleep(Math.max(0, info.reset * 1e3 - Date.now()), resolved.signal);
+  const existing = scopes.get(host);
+  if (existing !== void 0 && deadlineMs <= existing) {
+    return;
   }
+  scopes.set(host, deadlineMs);
 };
-const reportFailure = (url, method, attempt, normalized, resolved, nextDelayMs) => {
-  const context = buildErrorContext(url, method, attempt, normalized, nextDelayMs);
-  if (nextDelayMs !== void 0) {
-    safeInvoke(
-      resolved.onRetry ?? resolved.onError,
-      resolved.onRetry === void 0 ? "onError" : "onRetry",
-      normalized,
-      context
-    );
+const awaitPaceDeadline = async (owner, host, resolved, hookContext) => {
+  if (owner === void 0 || !resolved.paceWithRateLimit || resolved.ignorePaceDeadline) {
+    return;
+  }
+  const deadlineMs = paceDeadlines.get(owner)?.get(host);
+  if (deadlineMs === void 0) {
+    return;
+  }
+  const delayMs = deadlineMs - Date.now();
+  if (delayMs <= 0) {
+    paceDeadlines.get(owner)?.delete(host);
+    return;
+  }
+  safeInvoke(resolved.onPace, "onPace", resolved.onHookError, { ...hookContext, delayMs });
+  await sleepForPacing(delayMs, resolved, hookContext);
+};
+const paceAfterSuccess = async (response, resolved, hookContext, rateLimit, owner, host) => {
+  if (!resolved.paceWithRateLimit) {
     return;
   }
-  safeInvoke(resolved.onError, "onError", normalized, context);
+  const info = rateLimit ?? getRateLimitInfo(response.headers);
+  if (info !== void 0 && info.remaining < resolved.rateLimitFloor) {
+    const rawDeadlineMs = info.reset * 1e3;
+    const now = Date.now();
+    const deadlineMs = Math.min(rawDeadlineMs, now + MAX_PACE_WAIT_MS);
+    const delayMs = Math.max(0, deadlineMs - now);
+    if (owner !== void 0 && host !== void 0) {
+      recordPaceDeadline(owner, host, deadlineMs);
+    }
+    safeInvoke(resolved.onPace, "onPace", resolved.onHookError, { ...hookContext, delayMs });
+    await sleepForPacing(delayMs, resolved, hookContext);
+  }
 };
 const isPacingAbort = (resolved, error) => resolved.paceWithRateLimit && error instanceof AniLinkNetworkError && error.code === AniLinkErrorCodes.ABORTED && !axios.isCancel(error);
 const rethrowIfPacingAbort = (resolved, error) => {
@@ -485,17 +809,46 @@ const rethrowIfPacingAbort = (resolved, error) => {
     throw error;
   }
 };
-const executeWithRetry = async (options, resolved, stateKey, rawPassthrough = false) => {
+
+const executeWithRetry = async (options, resolved, stateOwner, rawPassthrough = false) => {
   const { url, method, data, headers } = options;
   const policy = resolved.retry;
-  const circuit = resolved.circuitBreaker !== void 0 && stateKey !== void 0 ? getCircuitState(stateKey, circuitScopeOf(url)) : void 0;
-  const budgetState = getRetryBudgetState(stateKey, resolved.retryBudget);
+  const requestId = randomUUID();
+  const host = circuitScopeOf(url, requestId);
+  const circuit = resolved.circuitBreaker !== void 0 && stateOwner !== void 0 ? getCircuitState(stateOwner, host) : void 0;
+  const budgetState = getRetryBudgetState(stateOwner, resolved.retryBudget);
   let attempt = 0;
   for (; ; ) {
-    throwIfCircuitOpen(circuit, resolved.circuitBreaker);
     const startedAt = Date.now();
-    const hookContext = { url, method, attempt: attempt + 1 };
-    safeInvoke(resolved.onRequestStart, "onRequestStart", hookContext);
+    const hookContext = { requestId, url, method, attempt: attempt + 1 };
+    const circuitError = checkCircuitOpen(circuit, resolved.circuitBreaker);
+    if (circuitError !== void 0) {
+      safeInvoke(
+        resolved.onRequestStart,
+        "onRequestStart",
+        resolved.onHookError,
+        hookContext
+      );
+      stampRequestId(circuitError, requestId);
+      safeInvoke(
+        resolved.onError,
+        "onError",
+        resolved.onHookError,
+        circuitError,
+        buildErrorContext(requestId, url, method, attempt + 1, circuitError)
+      );
+      throw circuitError;
+    }
+    try {
+      await awaitPaceDeadline(stateOwner, host, resolved, hookContext);
+    } catch (paceError) {
+      if (circuit !== void 0 && circuit.probeInFlight) {
+        recordCircuitSuccess(circuit, resolved, hookContext, host);
+      }
+      throw paceError;
+    }
+    safeInvoke(resolved.onRequestStart, "onRequestStart", resolved.onHookError, hookContext);
+    let responseReported = false;
     try {
       const response = await axiosClient({
         url,
@@ -507,41 +860,111 @@ const executeWithRetry = async (options, resolved, stateKey, rawPassthrough = fa
         httpAgent: resolved.httpAgent,
         httpsAgent: resolved.httpsAgent
       });
-      safeInvoke(resolved.onResponse, "onResponse", {
+      const rateLimit = getRateLimitInfo(response.headers);
+      safeInvoke(resolved.onResponse, "onResponse", resolved.onHookError, {
         ...hookContext,
-        durationMs: Date.now() - startedAt
+        durationMs: Date.now() - startedAt,
+        ...rateLimit !== void 0 ? { rateLimit } : {}
       });
-      recordCircuitSuccess(circuit);
-      await paceAfterSuccess(response, resolved);
-      return rawPassthrough ? response.data : unwrapGraphQLResponse(response.data);
+      responseReported = true;
+      const result = rawPassthrough ? response.data : unwrapGraphQLResponse(
+        response.data,
+        response.headers
+      );
+      recordCircuitSuccess(circuit, resolved, hookContext, host);
+      await paceAfterSuccess(response, resolved, hookContext, rateLimit, stateOwner, host);
+      return result;
     } catch (error) {
       rethrowIfPacingAbort(resolved, error);
-      safeInvoke(resolved.onResponse, "onResponse", {
-        ...hookContext,
-        durationMs: Date.now() - startedAt
+      if (!responseReported) {
+        safeInvoke(resolved.onResponse, "onResponse", resolved.onHookError, {
+          ...hookContext,
+          durationMs: Date.now() - startedAt
+        });
+      }
+      const normalized = normalizeRequestError(resolved, error, rawPassthrough, requestId);
+      const wasProbe = circuit?.probeInFlight === true;
+      recordCircuitFailure(
+        circuit,
+        resolved.circuitBreaker,
+        normalized,
+        resolved,
+        hookContext,
+        host
+      );
+      const delay = computeNextRetryDelay({
+        normalized,
+        rawError: error,
+        attempt,
+        policy,
+        budgetState,
+        budget: resolved.retryBudget,
+        wasProbe
       });
-      const normalized = normalizeRequestError(resolved, error, rawPassthrough);
-      recordCircuitFailure(circuit, resolved.circuitBreaker);
-      const delay = policy === null || budgetState === void 0 ? policy === null ? null : getRetryDelay(normalized, error, attempt, policy) : budgetState.retriesUsed >= resolved.retryBudget.maxRetriesPerWindow ? null : getRetryDelay(normalized, error, attempt, policy);
       if (delay !== null && budgetState !== void 0) {
         budgetState.retriesUsed += 1;
       }
-      reportFailure(url, method, attempt + 1, normalized, resolved, delay ?? void 0);
+      reportFailure(
+        requestId,
+        url,
+        method,
+        attempt + 1,
+        normalized,
+        resolved,
+        delay ?? void 0
+      );
       if (delay === null) {
         throw normalized;
       }
       attempt += 1;
-      await sleep(delay, resolved.signal);
+      await sleep(delay, resolved.signal, requestId);
+    }
+  }
+};
+const buildAuthCacheKey = (token) => token === void 0 ? "none" : `bearer:${createHash("sha256").update(token).digest("hex").slice(0, 16)}`;
+const buildCacheAuthKey = (hasBearerToken, hasCredentialHeaders, token) => {
+  if (hasCredentialHeaders) {
+    return void 0;
+  }
+  if (hasBearerToken) {
+    return buildAuthCacheKey(token);
+  }
+  return buildAuthCacheKey(void 0);
+};
+let warnedOptionsKeyedState = false;
+const warnOptionsKeyedState = (onHookError) => {
+  if (warnedOptionsKeyedState) {
+    return;
+  }
+  warnedOptionsKeyedState = true;
+  const message = "[AniLink] circuit-breaker/retry-budget state is keyed by the per-request options object because no stateOwner was passed. Pass a stable stateOwner (or reuse one options object across calls) so failure streaks accumulate.";
+  if (onHookError !== void 0) {
+    try {
+      onHookError("stateOwner", new Error(message));
+    } catch {
     }
+    return;
   }
+  console.warn(message);
 };
-const sendRequest = async (url, method, data, auth, ...requestOptions) => {
-  const [requiresAuth = false, options, operation, contentType] = requestOptions;
+const sendRequest = async (url, method, data, auth, sendOptions) => {
+  const {
+    requiresAuth = false,
+    options,
+    operation,
+    protocol,
+    contentType,
+    stateOwner
+  } = sendOptions ?? {};
+  const isRestCall = protocol === "rest" || protocol === void 0 && contentType !== void 0;
   const resolvedAuth = typeof auth === "string" ? { token: auth } : auth;
   const hasBearerToken = resolvedAuth?.token !== void 0 && resolvedAuth.token !== "";
   const hasAuthorizationHeader = Object.entries(resolvedAuth?.headers ?? {}).some(
     ([key, value]) => key.toLowerCase() === "authorization" && value !== ""
   );
+  const hasCredentialHeaders = Object.entries(resolvedAuth?.headers ?? {}).some(
+    ([, value]) => value !== ""
+  );
   const hasAuthMaterial = hasBearerToken || hasAuthorizationHeader;
   if (requiresAuth && !hasAuthMaterial) {
     throw new AniLinkAuthError(operation);
@@ -554,12 +977,41 @@ const sendRequest = async (url, method, data, auth, ...requestOptions) => {
   if (hasBearerToken && !hasAuthorizationHeader) {
     headers.Authorization = `Bearer ${resolvedAuth.token}`;
   }
+  const resolved = resolveRequestOptions(options);
+  if (stateOwner === void 0 && options !== void 0 && (resolved.circuitBreaker !== void 0 || resolved.retryBudget !== void 0)) {
+    warnOptionsKeyedState(resolved.onHookError);
+  }
+  const cacheEnabled = resolved.responseCache !== void 0 && method === "GET";
+  const cacheAuthKey = cacheEnabled ? buildCacheAuthKey(hasBearerToken, hasCredentialHeaders, resolvedAuth?.token) : void 0;
+  const cacheActive = cacheEnabled && cacheAuthKey !== void 0;
+  if (cacheActive) {
+    const cached = resolved.responseCache.get(method, url, data, cacheAuthKey);
+    if (cached !== void 0) {
+      const requestId = randomUUID();
+      const hookContext = { requestId, url, method, attempt: 1 };
+      safeInvoke(
+        resolved.onRequestStart,
+        "onRequestStart",
+        resolved.onHookError,
+        hookContext
+      );
+      safeInvoke(resolved.onResponse, "onResponse", resolved.onHookError, {
+        ...hookContext,
+        durationMs: 0,
+        cacheHit: true
+      });
+      return cached;
+    }
+  }
   const result = await executeWithRetry(
     { url, method, data, headers },
-    resolveRequestOptions(options),
-    options,
-    contentType !== void 0
+    resolved,
+    stateOwner ?? options,
+    isRestCall
   );
+  if (cacheActive) {
+    resolved.responseCache.set(method, url, data, cacheAuthKey, result);
+  }
   return result;
 };
 
@@ -573,6 +1025,13 @@ const resolveOperationLabel = (operation) => {
   return typeof name === "string" && name.length > 0 ? name : void 0;
 };
 class BaseOperation {
+  /**
+   * Stable per-instance object keying cross-request transport state (the
+   * circuit breaker and retry budget). One per instance so failure streaks
+   * accumulate across every request this operation dispatches, regardless
+   * of per-request option objects.
+   */
+  stateOwner = {};
   /**
    * The authentication token shared by all operations of an instance.
    */
@@ -626,25 +1085,24 @@ class BaseOperation {
    * @typeParam T - The parsed response type returned verbatim by the pipeline.
    * @param url - The absolute endpoint URL to call.
    * @param method - The HTTP method for the call.
-   * @param data - The request body payload, when the call carries one.
-   * @param requiresAuth - Whether the operation requires an authentication token.
-   * @param operation - Human-readable operation name included in missing-token auth errors. Defaults to the concrete subclass name.
-   * @param transportOptions - Optional per-request transport settings merged over the instance-level ones. A field set here wins; unset fields keep the instance value.
-   * @param contentType - Optional `Content-Type` override. When provided, the response body is returned verbatim instead of being unwrapped as a GraphQL envelope.
+   * @param data - The request body payload, when the call carries one: a JSON-serializable object, or a pre-encoded string body (for example form-urlencoded OAuth grants).
+   * @param options - Named trailing options; see {@link DispatchOptions}.
    * @returns Whatever the shared pipeline resolves for the call.
    * @throws An {@link AniLinkAuthError} when `requiresAuth` is true and no token is set, or a normalized {@link AniLinkError} when the request fails.
    */
-  async dispatch(url, method, data, requiresAuth = false, operation, transportOptions, contentType) {
-    return await sendRequest(
-      url,
-      method,
-      data,
-      this.requestAuth,
-      requiresAuth || void 0,
-      mergeOptions(this.resolvedOptions, transportOptions),
-      operation ?? resolveOperationLabel(this),
-      contentType
-    );
+  async dispatch(url, method, data, options = {}) {
+    const { requiresAuth, operation, transportOptions, contentType, protocol } = options;
+    return await sendRequest(url, method, data, this.requestAuth, {
+      requiresAuth: requiresAuth || void 0,
+      options: mergeOptions(this.resolvedOptions, transportOptions),
+      operation: operation ?? resolveOperationLabel(this),
+      contentType,
+      protocol,
+      // The instance keys cross-request transport state (circuit
+      // breaker, retry budget) so failure streaks accumulate across
+      // requests even when each call carries fresh per-request options.
+      stateOwner: this.stateOwner
+    });
   }
 }
 
@@ -653,12 +1111,42 @@ const isPrimitive = (mapping) => typeof mapping === "string" && PRIMITIVES.inclu
 const isArrayType = (mapping) => typeof mapping === "string" && mapping.endsWith("[]");
 const isAllowlist = (mapping) => Array.isArray(mapping);
 const isObjectMapping = (mapping) => typeof mapping === "object" && mapping !== null && !Array.isArray(mapping);
-const describeValue = (value) => {
+const SENSITIVE_KEY_PATTERN = /token|secret|password|authorization|cookie|credential|api[-_]?key|pass|session|otp|bearer/i;
+const isPlainObject$1 = (value) => {
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+};
+const redactValue = (key, value) => {
+  if (SENSITIVE_KEY_PATTERN.test(key)) {
+    return "[REDACTED]";
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => redactValue(key, item));
+  }
+  if (value !== null && typeof value === "object" && !isPlainObject$1(value)) {
+    const entries = Object.entries(value);
+    if (entries.length === 0) {
+      return value;
+    }
+    return Object.assign(
+      Object.create(Object.getPrototypeOf(value)),
+      Object.fromEntries(entries.map(([k, v]) => [k, redactValue(k, v)]))
+    );
+  }
+  if (value !== null && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, redactValue(k, v)]));
+  }
+  return value;
+};
+const describeValue = (path, value) => {
+  if (SENSITIVE_KEY_PATTERN.test(path)) {
+    return "[REDACTED]";
+  }
   if (value === null || typeof value !== "object" && typeof value !== "function") {
     return String(value);
   }
   try {
-    return JSON.stringify(value) ?? String(value);
+    return JSON.stringify(redactValue(path, value)) ?? String(value);
   } catch {
     return `[${typeof value}]`;
   }
@@ -666,14 +1154,18 @@ const describeValue = (value) => {
 const validateValue = (path, value, mapping, errors, rejectUnknownKeys) => {
   if (isPrimitive(mapping)) {
     if (typeof value !== mapping) {
-      errors.push(`Invalid ${path}: ${describeValue(value)}. Expected type: ${mapping}`);
+      errors.push(
+        `Invalid ${path}: ${describeValue(path, value)}. Expected type: ${mapping}`
+      );
     }
     return;
   }
   if (isArrayType(mapping)) {
     const elementType = mapping.slice(0, -2);
     if (!Array.isArray(value) || !value.every((element) => typeof element === elementType)) {
-      errors.push(`Invalid ${path}: ${describeValue(value)}. Expected type: ${mapping}`);
+      errors.push(
+        `Invalid ${path}: ${describeValue(path, value)}. Expected type: ${mapping}`
+      );
     }
     return;
   }
@@ -682,13 +1174,13 @@ const validateValue = (path, value, mapping, errors, rejectUnknownKeys) => {
       value.forEach((item, index) => {
         if (!mapping.includes(item)) {
           errors.push(
-            `Invalid ${path}[${index}]: ${describeValue(item)}. Expected one of: ${mapping.join(", ")}`
+            `Invalid ${path}[${index}]: ${describeValue(`${path}[${index}]`, item)}. Expected one of: ${mapping.join(", ")}`
           );
         }
       });
     } else if (!mapping.includes(value)) {
       errors.push(
-        `Invalid ${path}: ${describeValue(value)}. Expected one of: ${mapping.join(", ")}`
+        `Invalid ${path}: ${describeValue(path, value)}. Expected one of: ${mapping.join(", ")}`
       );
     }
     return;
@@ -705,7 +1197,7 @@ const validateValue = (path, value, mapping, errors, rejectUnknownKeys) => {
 };
 const validateObject = (path, value, mapping, errors, rejectUnknownKeys) => {
   if (value === null || typeof value !== "object") {
-    errors.push(`Invalid ${path}: ${describeValue(value)}. Expected an object.`);
+    errors.push(`Invalid ${path}: ${describeValue(path, value)}. Expected an object.`);
     return;
   }
   for (const [prop, propValue] of Object.entries(value)) {
@@ -774,22 +1266,18 @@ class GraphQLOperation extends BaseOperation {
    *
    * @param query - The GraphQL document to execute.
    * @param variables - The variables for the document. When omitted the request body contains only the query.
-   * @param requiresAuth - Whether the operation requires an authentication token.
-   * @param operation - Optional human-readable operation name included in missing-token auth errors. Defaults to the concrete operation class name.
-   * @param transportOptions - Optional per-request transport settings merged over the instance-level ones. A field set here wins; unset fields keep the instance value.
+   * @param options - Named trailing options; see {@link GraphQLRequestOptions}.
    * @returns The unwrapped response data. For documents with a single root field this is the bare field value; otherwise it is the full `{ data }` envelope.
    * @throws An {@link AniLinkAuthError} when `requiresAuth` is true and no token is set, or a normalized {@link AniLinkError} when the request fails.
    */
-  async request(query, variables, requiresAuth = false, operation, transportOptions) {
+  async request(query, variables, options = {}) {
+    const { requiresAuth, operation, transportOptions } = options;
     const data = variables === void 0 ? { query } : { query, variables };
-    return await this.dispatch(
-      this.graphqlUrl,
-      "POST",
-      data,
+    return await this.dispatch(this.graphqlUrl, "POST", data, {
       requiresAuth,
       operation,
       transportOptions
-    );
+    });
   }
   /**
    * Runs the shared validate-then-dispatch pipeline for an operation.
@@ -817,7 +1305,7 @@ class GraphQLOperation extends BaseOperation {
     if (mappings && variables !== void 0) {
       validateVariables(variables, mappings);
     }
-    return await this.request(query, variables, requiresAuth, void 0, transportOptions);
+    return await this.request(query, variables, { requiresAuth, transportOptions });
   }
 }
 
@@ -855,7 +1343,7 @@ class CustomRequest extends AniListOperation {
    * @param options - Optional per-request transport settings merged over the instance-level ones for this call only.
    * @returns A promise that resolves to the unwrapped response data for single-root-field documents, or the full `{ data }` envelope otherwise.
    * @throws An {@link AniLinkValidationError} when the query is empty or does not declare a `query` or `mutation` operation.
-   * @throws An `AniLinkError` when the request fails. When AniList returns partial success (some fields resolve while others fail inside an HTTP 200 envelope), the thrown {@link AniLinkGraphQLError} exposes the resolved portion via its `partialData` field, so the fields that did resolve remain recoverable from the error.
+   * @throws An `AniLinkError` when the request fails. When AniList returns partial success (some fields resolve while others fail inside an HTTP 200 envelope), the thrown `AniLinkGraphQLError` exposes the resolved portion via its `partialData` field, so the fields that did resolve remain recoverable from the error.
    * @see https://docs.anilist.co/reference/query
    * @see https://docs.anilist.co/reference/mutation
    */
@@ -865,7 +1353,7 @@ class CustomRequest extends AniListOperation {
         "custom() requires a GraphQL document declaring a query or mutation operation"
       ]);
     }
-    return await this.request(query, variables, false, void 0, options);
+    return await this.request(query, variables, { transportOptions: options });
   }
 }
 
@@ -924,34 +1412,70 @@ function resolvePositiveInt(value, fallback) {
 function resolveCappedInt(value, max, fallback) {
   return Math.min(resolvePositiveInt(value, fallback), max);
 }
-async function fetchWithLookAhead(fetch, extractHasMore, ...rest) {
-  let extractNextKey;
-  let firstKey;
-  let numericStart;
-  let maxEntries;
-  let concurrency;
-  if (rest.length === 4) {
-    [extractNextKey, firstKey, maxEntries, concurrency] = rest;
-    if (extractNextKey === void 0) {
-      numericStart = firstKey;
-    }
-  } else {
-    [numericStart, maxEntries, concurrency] = rest;
-    firstKey = numericStart;
+function bridgeAbortSignal(external) {
+  const controller = new AbortController();
+  if (external === void 0) {
+    return { signal: controller.signal, dispose: () => controller.abort() };
+  }
+  if (external.aborted) {
+    controller.abort();
+    return { signal: controller.signal, dispose: () => {
+    } };
+  }
+  const onAbort = () => controller.abort();
+  external.addEventListener("abort", onAbort, { once: true });
+  return {
+    signal: controller.signal,
+    dispose: () => {
+      controller.abort();
+      external.removeEventListener("abort", onAbort);
+    }
+  };
+}
+async function fetchWithLookAhead(fetch, extractHasMore, extractNextKeyOrStartNumber, firstKeyOrMaxEntries, maxEntriesOrConcurrency, concurrencyOrSignal, maybeSignal) {
+  if (extractNextKeyOrStartNumber === void 0) {
+    return fetchNumericWithLookAhead(
+      fetch,
+      extractHasMore,
+      firstKeyOrMaxEntries,
+      maxEntriesOrConcurrency,
+      concurrencyOrSignal,
+      maybeSignal
+    );
+  }
+  if (typeof extractNextKeyOrStartNumber === "function") {
+    return fetchCursorChain(
+      fetch,
+      extractHasMore,
+      extractNextKeyOrStartNumber,
+      firstKeyOrMaxEntries,
+      maxEntriesOrConcurrency);
   }
+  return fetchNumericWithLookAhead(
+    fetch,
+    extractHasMore,
+    extractNextKeyOrStartNumber,
+    firstKeyOrMaxEntries,
+    maxEntriesOrConcurrency,
+    typeof concurrencyOrSignal === "number" ? void 0 : concurrencyOrSignal
+  );
+}
+async function fetchNumericWithLookAhead(fetch, extractHasMore, startNumber, maxEntries, concurrency, signal) {
   const responses = [];
   const pending = [];
   let launched = 0;
   let count = 0;
   let truncated = false;
-  let pendingCursorKey = extractNextKey === void 0 ? void 0 : firstKey;
-  const effectiveConcurrency = extractNextKey === void 0 ? concurrency : 1;
   while (count < maxEntries) {
-    while (launched < maxEntries && launched - count < effectiveConcurrency) {
+    if (signal?.aborted) {
+      await Promise.allSettled(pending.slice(count));
+      responses.length = count;
+      return { responses, count, truncated: false };
+    }
+    while (launched < maxEntries && launched - count < concurrency) {
       const slot = launched;
-      const key = extractNextKey === void 0 ? numericStart + slot : pendingCursorKey;
       launched += 1;
-      const request = fetch(key).then((response) => {
+      const request = fetch(startNumber + slot).then((response) => {
         responses[slot] = response;
       });
       pending[slot] = request;
@@ -959,25 +1483,55 @@ async function fetchWithLookAhead(fetch, extractHasMore, ...rest) {
       });
     }
     if (count >= launched) break;
-    await pending[count];
+    try {
+      await pending[count];
+    } catch (err) {
+      if (signal?.aborted) {
+        await Promise.allSettled(pending.slice(count + 1));
+        responses.length = count;
+        return { responses, count, truncated: false };
+      }
+      throw err;
+    }
     count += 1;
-    const consumed = responses[count - 1];
-    const hasMore = extractHasMore(consumed);
-    if (!hasMore) {
+    if (!extractHasMore(responses[count - 1])) {
       await Promise.allSettled(pending.slice(count));
       responses.length = count;
       return { responses, count, truncated: false };
     }
-    if (extractNextKey !== void 0) {
-      pendingCursorKey = extractNextKey(consumed);
-    }
     if (count >= maxEntries) {
       await Promise.allSettled(pending.slice(count));
       truncated = true;
       break;
     }
   }
-  return { responses, count, truncated };
+  return { responses, count, truncated };
+}
+async function fetchCursorChain(fetch, extractHasMore, extractNextKey, firstKey, maxEntries, signal) {
+  const responses = [];
+  let key = firstKey;
+  while (responses.length < maxEntries && key !== void 0) {
+    let entry;
+    try {
+      entry = await fetch(key);
+    } catch (err) {
+      throw err;
+    }
+    responses.push(entry);
+    if (!extractHasMore(entry)) {
+      return { responses, count: responses.length, truncated: false };
+    }
+    key = extractNextKey(entry);
+  }
+  return {
+    responses,
+    count: responses.length,
+    // A degenerate guard (maxEntries <= 0) fetched nothing and cut
+    // nothing short: `truncated` reports whether the guard ended a run
+    // that still had data, matching the numeric driver's `while (count <
+    // maxEntries)` early exit.
+    truncated: responses.length >= maxEntries && maxEntries > 0
+  };
 }
 
 const DEFAULT_PER_PAGE = 50;
@@ -986,6 +1540,10 @@ const DEFAULT_MAX_PAGES = 100;
 const DEFAULT_PER_CHUNK = 500;
 const MAX_PER_CHUNK = DEFAULT_PER_CHUNK;
 const DEFAULT_MAX_CHUNKS = 100;
+const safeCallback = (callback, name, payload) => {
+  safeInvoke(callback, name, void 0, payload);
+};
+const DEFAULT_CONCURRENCY = 3;
 const MAX_CONCURRENCY = 8;
 function extractHasMore(response) {
   if (typeof response !== "object" || response === null) return false;
@@ -1002,59 +1560,130 @@ async function paginate(fetchPage, itemsKey, options) {
   const perPage = resolveCappedInt(options?.perPage, MAX_PER_PAGE, DEFAULT_PER_PAGE);
   const startPage = resolvePositiveInt(options?.startPage, 1);
   const maxPages = resolvePositiveInt(options?.maxPages, DEFAULT_MAX_PAGES);
-  const concurrency = resolveCappedInt(options?.concurrency, MAX_CONCURRENCY, 1);
-  const { responses, count, truncated } = await fetchWithLookAhead(
-    (number) => fetchPage(number, perPage),
-    extractHasMore,
-    startPage,
-    maxPages,
-    concurrency
+  const concurrency = resolveCappedInt(
+    options?.concurrency,
+    MAX_CONCURRENCY,
+    DEFAULT_CONCURRENCY
   );
-  const items = [];
-  const pages = [];
-  for (const response of responses) {
-    const pageItems = response[itemsKey];
-    pages.push({ pageInfo: response.pageInfo, items: pageItems });
-    items.push(...pageItems);
-  }
-  return { items, pages, pageCount: count, truncated };
+  const { signal, dispose } = bridgeAbortSignal(options?.signal);
+  try {
+    const { responses, count, truncated } = await fetchWithLookAhead(
+      (number) => fetchPage(number, perPage, signal),
+      extractHasMore,
+      startPage,
+      maxPages,
+      concurrency,
+      signal
+    );
+    const items = [];
+    const pages = [];
+    for (const response of responses) {
+      const pageItems = response[itemsKey];
+      pages.push({ pageInfo: response.pageInfo, items: pageItems });
+      items.push(...pageItems);
+      safeCallback(options?.onPage, "onPage", {
+        pageInfo: response.pageInfo,
+        items: pageItems
+      });
+    }
+    return { items, pages, pageCount: count, truncated };
+  } finally {
+    dispose();
+  }
 }
 async function* paginatePages(fetchPage, options) {
   const perPage = resolveCappedInt(options?.perPage, MAX_PER_PAGE, DEFAULT_PER_PAGE);
   const startPage = resolvePositiveInt(options?.startPage, 1);
   const maxPages = resolvePositiveInt(options?.maxPages, DEFAULT_MAX_PAGES);
-  let page = startPage;
-  let pageCount = 0;
-  while (pageCount < maxPages) {
-    const response = await fetchPage(page, perPage);
-    pageCount += 1;
-    yield response;
-    if (!response.pageInfo.hasNextPage || pageCount >= maxPages) {
-      break;
+  const concurrency = resolveCappedInt(
+    options?.concurrency,
+    MAX_CONCURRENCY,
+    DEFAULT_CONCURRENCY
+  );
+  const { signal, dispose } = bridgeAbortSignal(options?.signal);
+  if (signal.aborted) {
+    dispose();
+    return;
+  }
+  const pending = /* @__PURE__ */ new Map();
+  let nextToLaunch = startPage;
+  let nextToYield = startPage;
+  let terminal = false;
+  const launchWindow = () => {
+    while (!terminal && nextToLaunch - startPage < maxPages && pending.size < concurrency) {
+      const page = nextToLaunch;
+      nextToLaunch += 1;
+      const request = fetchPage(page, perPage, signal);
+      pending.set(page, request);
+      void request.catch(() => {
+      });
     }
-    page += 1;
+  };
+  try {
+    while (nextToYield - startPage < maxPages) {
+      launchWindow();
+      const page = nextToYield;
+      const request = pending.get(page);
+      if (request === void 0) {
+        break;
+      }
+      let response;
+      try {
+        response = await request;
+      } catch (err) {
+        if (signal.aborted) {
+          break;
+        }
+        throw err;
+      }
+      pending.delete(page);
+      nextToYield += 1;
+      yield response;
+      if (!response.pageInfo.hasNextPage) {
+        terminal = true;
+        await Promise.allSettled([...pending.values()]);
+        break;
+      }
+    }
+  } finally {
+    dispose();
+    pending.clear();
   }
 }
 async function paginateChunks(fetchChunk, itemsKey, options) {
   const perChunk = resolveCappedInt(options?.perChunk, MAX_PER_CHUNK, DEFAULT_PER_CHUNK);
   const startChunk = resolvePositiveInt(options?.startChunk, 1);
   const maxChunks = resolvePositiveInt(options?.maxChunks, DEFAULT_MAX_CHUNKS);
-  const concurrency = resolveCappedInt(options?.concurrency, MAX_CONCURRENCY, 1);
-  const { responses, count, truncated } = await fetchWithLookAhead(
-    (number) => fetchChunk(number, perChunk),
-    extractHasMore,
-    startChunk,
-    maxChunks,
-    concurrency
+  const concurrency = resolveCappedInt(
+    options?.concurrency,
+    MAX_CONCURRENCY,
+    DEFAULT_CONCURRENCY
   );
-  const items = [];
-  const chunks = [];
-  for (const response of responses) {
-    const chunkItems = response[itemsKey];
-    chunks.push({ hasNextChunk: response.hasNextChunk, items: chunkItems });
-    items.push(...chunkItems);
-  }
-  return { items, chunks, chunkCount: count, truncated };
+  const { signal, dispose } = bridgeAbortSignal(options?.signal);
+  try {
+    const { responses, count, truncated } = await fetchWithLookAhead(
+      (number) => fetchChunk(number, perChunk, signal),
+      extractHasMore,
+      startChunk,
+      maxChunks,
+      concurrency,
+      signal
+    );
+    const items = [];
+    const chunks = [];
+    for (const response of responses) {
+      const chunkItems = response[itemsKey];
+      chunks.push({ hasNextChunk: response.hasNextChunk, items: chunkItems });
+      items.push(...chunkItems);
+      safeCallback(options?.onChunk, "onChunk", {
+        hasNextChunk: response.hasNextChunk,
+        items: chunkItems
+      });
+    }
+    return { items, chunks, chunkCount: count, truncated };
+  } finally {
+    dispose();
+  }
 }
 
 const MediaSortMappings = [
@@ -3137,7 +3766,7 @@ class GenreCollectionQuery extends AniListOperation {
   /**
    * {@link GenreCollectionQuery.genreCollection} sends a query request to get genre collections.
    *
-   * @returns The genre strings returned by AniList.
+   * @returns The list of genre strings returned by AniList.
    * @see https://docs.anilist.co/reference/query
    * @param options - Optional {@link RequestOptions} merged over the instance-level settings for this call only.
    * @example
@@ -5707,7 +6336,7 @@ class ToggleLikeMutation extends AniListOperation {
   /**
    * {@link ToggleLikeMutation.toggleLike} sends a mutation request to toggle a like.
    *
-   * @deprecated Prefer {@link ToggleLikeV2Mutation.toggleLikeV2}, which returns the richer {@link Likeable} union (activity, activity reply, thread, or thread comment) instead of a bare user.
+   * @deprecated Prefer `ToggleLikeV2Mutation.toggleLikeV2`, which returns the richer `Likeable` union (activity, activity reply, thread, or thread comment) instead of a bare user.
    * @param variables - Values from {@link ToggleLikeVariables} for the mutation.
    * @returns The {@link BasicUser} returned by the mutation.
    * @throws Throws if no authentication token is configured, `id` or `type` is missing or invalid, or the mutation request fails.
@@ -6766,7 +7395,7 @@ class SaveMediaListEntryMutation extends AniListOperation {
 }
 
 function op(name, operationClass) {
-  return { name, operationClass };
+  return { name, operationClass, methodName: name };
 }
 function opAs(name, operationClass, methodName) {
   return { name, operationClass, methodName };
@@ -6852,52 +7481,125 @@ const ANILIST_OPERATION_REGISTRY = {
   ]
 };
 
-function instantiateCategory(category, authToken, options) {
-  return ANILIST_OPERATION_REGISTRY[category].map((entry) => ({
-    name: entry.name,
-    methodName: entry.methodName,
-    instance: new entry.operationClass(authToken, options)
-  }));
-}
-function bindEntries(entries) {
-  const bound = {};
-  for (const { name, instance, methodName } of entries) {
-    const method = instance[methodName ?? name];
+function validateCategoryMethods(category) {
+  for (const entry of ANILIST_OPERATION_REGISTRY[category]) {
+    const method = entry.operationClass.prototype[entry.methodName];
     if (typeof method !== "function") {
       throw new TypeError(
-        `Operation "${name}" does not expose a "${methodName ?? name}" method to bind.`
+        `Operation "${entry.name}" does not expose a "${entry.methodName}" method to bind.`
       );
     }
-    bound[name] = method.bind(instance);
   }
-  return bound;
+}
+function buildLazyGroup(category, authToken, options) {
+  const entries = ANILIST_OPERATION_REGISTRY[category];
+  const descriptors = {};
+  for (const entry of entries) {
+    let bound;
+    descriptors[entry.name] = {
+      enumerable: true,
+      configurable: false,
+      get() {
+        if (bound === void 0) {
+          const instance = new entry.operationClass(
+            authToken,
+            options
+          );
+          const method = instance[entry.methodName];
+          if (typeof method !== "function") {
+            throw new TypeError(
+              `Operation "${entry.name}" does not expose a "${entry.methodName}" method to bind.`
+            );
+          }
+          bound = method.bind(instance);
+        }
+        return bound;
+      }
+    };
+  }
+  return Object.defineProperties({}, descriptors);
 }
 function buildAniListWiring(authToken, options) {
-  const customInstance = new CustomRequest(authToken, options);
-  const [queryEntries, pageEntries, mutationEntries] = ["query", "page", "mutation"].map((category) => instantiateCategory(category, authToken, options));
-  return {
-    custom: customInstance.custom.bind(customInstance),
-    query: {
-      ...bindEntries(queryEntries),
-      page: bindEntries(pageEntries)
+  for (const category of ["query", "page", "mutation"]) {
+    validateCategoryMethods(category);
+  }
+  const queryFacade = buildLazyGroup("query", authToken, options);
+  const pageFacade = buildLazyGroup("page", authToken, options);
+  const mutationFacade = buildLazyGroup("mutation", authToken, options);
+  Object.defineProperty(queryFacade, "page", {
+    value: pageFacade,
+    enumerable: true,
+    configurable: false,
+    writable: false
+  });
+  let customBound;
+  return Object.defineProperties(
+    {
+      query: queryFacade,
+      mutation: mutationFacade,
+      paginate,
+      paginatePages,
+      paginateChunks,
+      fuzzyDate,
+      flattenMediaListCollection
     },
-    mutation: bindEntries(mutationEntries),
-    paginate,
-    paginatePages,
-    paginateChunks,
-    fuzzyDate,
-    flattenMediaListCollection
-  };
+    {
+      custom: {
+        enumerable: true,
+        configurable: false,
+        get() {
+          if (customBound === void 0) {
+            const customInstance = new CustomRequest(authToken, options);
+            customBound = customInstance.custom.bind(customInstance);
+          }
+          return customBound;
+        }
+      }
+    }
+  );
 }
 
 function buildAniListApi(authToken, options) {
   return buildAniListWiring(authToken, options);
 }
 
+const TRANSPORT_OPTION_KEYS = [
+  "timeout",
+  "signal",
+  "exposeRawAxiosError",
+  "retry",
+  "paceWithRateLimit",
+  "rateLimitFloor",
+  "circuitBreaker",
+  "retryBudget",
+  "maxSockets",
+  "maxFreeSockets",
+  "onError",
+  "onRetry",
+  "onRequestStart",
+  "onResponse",
+  "onPace",
+  "onHookError",
+  "onCircuitOpen",
+  "onCircuitClose",
+  "ignorePaceDeadline",
+  "responseCache"
+];
+
 const resolveTransportOptions = (credentials, providerFields) => {
-  const options = Object.fromEntries(
-    Object.entries(credentials).filter(([key]) => !providerFields.includes(key))
-  );
+  const allowedKeys = /* @__PURE__ */ new Set([...TRANSPORT_OPTION_KEYS, ...providerFields]);
+  const options = {};
+  for (const [key, value] of Object.entries(credentials)) {
+    if (providerFields.includes(key)) continue;
+    if (!allowedKeys.has(key)) {
+      throw new TypeError(
+        `Unknown credential key "${key}". Valid transport options are: ${TRANSPORT_OPTION_KEYS.join(
+          ", "
+        )}. Provider auth fields are: ${providerFields.join(", ")}.`
+      );
+    }
+    options[key] = value;
+  }
   return Object.keys(options).length === 0 ? void 0 : options;
 };
 function resolveAniListCredentials(credentials) {
@@ -6944,37 +7646,40 @@ class RestOperation extends BaseOperation {
   /**
    * Sends one REST call through the shared transport pipeline.
    *
-   * GET and DELETE calls pass their parameters as a query string; POST and
-   * PUT calls send them as a JSON body. Responses are returned verbatim —
-   * REST providers have no GraphQL-style envelope, so no unwrapping happens.
+   * GET and DELETE calls pass their parameters as a query string; POST, PUT,
+   * and PATCH calls send them as a JSON body. Responses are returned verbatim
+   * — REST providers have no GraphQL-style envelope, so no unwrapping
+   * happens.
    *
    * @typeParam T - The expected parsed response body.
    * @param path - The endpoint path beginning with `/` (for example `/anime/{id}`); placeholders are substituted from `pathParams` before interpolation into the URL.
-   * @param options - The declarative request contract: method, auth requirement, content type, and per-request transport settings.
-   * @param query - Query parameters appended to the URL (GET/DELETE), when provided.
-   * @param body - The JSON request body (POST/PUT), when provided.
-   * @param pathParams - Values substituted into `{placeholder}` segments of `path`. Defaults to an empty map so paths without placeholders need none.
+   * @param options - The declarative request contract: method, auth requirement, content type, query/body/pathParams, and per-request transport settings.
    * @returns The parsed response body as-is.
    * @throws An {@link AniLinkAuthError} when `requiresAuth` is true and no token is set, or a normalized {@link AniLinkError} (typically `AniLinkRestError`) when the request fails.
    */
-  async execute(path, options = {}, query, body, pathParams = {}) {
-    const { method = "GET", requiresAuth = false, contentType, transportOptions } = options;
+  async execute(path, options = {}) {
+    const {
+      method = "GET",
+      requiresAuth = false,
+      contentType,
+      query,
+      body,
+      pathParams = {},
+      transportOptions
+    } = options;
     const interpolatedPath = path.replace(/\{(\w+)\}/g, (match, name) => {
       const value = pathParams[name];
       return value === void 0 ? match : encodeURIComponent(String(value));
     });
     const url = `${this.baseUrl}${interpolatedPath}${buildQueryString(query ?? {})}`;
-    const carriesBody = method === "POST" || method === "PUT";
+    const carriesBody = method === "POST" || method === "PUT" || method === "PATCH";
     const effectiveContentType = contentType ?? "application/json";
-    return await this.dispatch(
-      url,
-      method,
-      carriesBody ? body : void 0,
+    return await this.dispatch(url, method, carriesBody ? body : void 0, {
       requiresAuth,
-      void 0,
       transportOptions,
-      effectiveContentType
-    );
+      contentType: effectiveContentType,
+      protocol: "rest"
+    });
   }
 }
 
@@ -7004,13 +7709,204 @@ class MalAnimeOperation extends RestOperation {
    */
   async get(id, options = {}) {
     const { fields, ...transportOptions } = options;
-    return await this.execute(
-      "/anime/{id}",
-      { transportOptions },
-      fields === void 0 ? void 0 : { fields: Array.isArray(fields) ? fields.join(",") : fields },
-      void 0,
-      { id }
-    );
+    return await this.execute("/anime/{id}", {
+      transportOptions,
+      query: fields === void 0 ? void 0 : { fields: Array.isArray(fields) ? fields.join(",") : fields },
+      pathParams: { id }
+    });
+  }
+  /**
+   * Encodes a {@link MalAnimeListStatusUpdate} as the form-urlencoded body
+   * MAL's list-status endpoints require.
+   *
+   * MAL documents `PATCH /anime/{id}/my_list_status` with an
+   * `application/x-www-form-urlencoded` request body, not JSON. Array values
+   * (`tags`) are joined into the comma-separated string MAL expects.
+   *
+   * @param payload - The list-status fields to update.
+   * @returns The encoded body string, safe to pass as the request `data`.
+   */
+  encodeListStatusBody(payload) {
+    const params = new URLSearchParams();
+    for (const [key, value] of Object.entries(payload)) {
+      if (value === void 0) continue;
+      if (Array.isArray(value)) {
+        if (Array.isArray(value)) {
+          params.set(key, value.join(","));
+        }
+      } else {
+        params.set(key, String(value));
+      }
+    }
+    return params.toString();
+  }
+  /**
+   * {@link MalAnimeOperation.updateMyListStatus} updates the authenticated user's anime list status.
+   *
+   * It calls `PATCH /anime/{id}/my_list_status` through `RestOperation.execute` with `requiresAuth` and a form-urlencoded {@link MalAnimeListStatusUpdate} body (MAL rejects JSON on this endpoint), returning the updated {@link MalAnimeListStatus}. The facade alias is `MyAnimeListAnimeApi.updateMyListStatus` and it requires `MalCredentials.accessToken`.
+   *
+   * @param id - The MyAnimeList anime ID.
+   * @param payload - The list-status fields to update; a {@link MalAnimeListStatusUpdate} of only the fields to change.
+   * @param options - Optional field selection and transport settings; a {@link MalRequestOptions} merged over the instance defaults.
+   * @returns The updated {@link MalAnimeListStatus}.
+   * @throws An `AniLinkAuthError` without an access token, or a normalized request error.
+   * @example
+   * ```typescript
+   * const api = new AniLink({ mal: { accessToken: "mal-token" } }).mal;
+   * const status = await api.anime.updateMyListStatus(21, {
+   *   status: "watching",
+   *   num_watched_episodes: 10,
+   *   score: 9,
+   * });
+   * ```
+   * @see https://myanimelist.net/apiconfig/references/api/v2#tag/user-animelist/operation/anime_anime_id_my_list_status_put
+   */
+  async updateMyListStatus(id, payload, options = {}) {
+    const { fields, ...transportOptions } = options;
+    return await this.execute("/anime/{id}/my_list_status", {
+      method: "PATCH",
+      requiresAuth: true,
+      transportOptions,
+      contentType: "application/x-www-form-urlencoded",
+      body: this.encodeListStatusBody(payload),
+      query: fields === void 0 ? void 0 : { fields: Array.isArray(fields) ? fields.join(",") : fields },
+      pathParams: { id }
+    });
+  }
+  /**
+   * {@link MalAnimeOperation.deleteFromList} removes an anime from the authenticated user's list.
+   *
+   * It calls `DELETE /anime/{id}/my_list_status` through `RestOperation.execute` with `requiresAuth` and resolves with no body. The facade alias is `MyAnimeListAnimeApi.deleteFromList` and it requires `MalCredentials.accessToken`.
+   *
+   * @param id - The MyAnimeList anime ID.
+   * @param options - Optional transport settings; a {@link MalRequestOptions} merged over the instance defaults.
+   * @returns Resolves once the entry is deleted; the response carries no body.
+   * @throws An `AniLinkAuthError` without an access token, or a normalized request error.
+   * @example
+   * ```typescript
+   * const api = new AniLink({ mal: { accessToken: "mal-token" } }).mal;
+   * await api.anime.deleteFromList(21);
+   * ```
+   * @see https://myanimelist.net/apiconfig/references/api/v2#tag/user-animelist/operation/anime_anime_id_my_list_status_delete
+   */
+  async deleteFromList(id, options = {}) {
+    const { fields: _ignoredFields, ...transportOptions } = options;
+    await this.execute("/anime/{id}/my_list_status", {
+      method: "DELETE",
+      requiresAuth: true,
+      transportOptions,
+      pathParams: { id }
+    });
+  }
+}
+
+class MalMangaOperation extends RestOperation {
+  /** The base URL for MyAnimeList API v2, from {@link MAL_API_BASE_URL}. */
+  baseUrl = MAL_API_BASE_URL;
+  /**
+   * {@link MalMangaOperation.get} gets one manga by its MyAnimeList ID.
+   *
+   * It calls `GET /manga/{id}` through `RestOperation.execute` and returns a {@link MalManga} shaped by {@link MalRequestOptions.fields}. The facade alias is `MyAnimeListMangaApi.get`.
+   *
+   * @param id - The MyAnimeList manga ID.
+   * @param options - Optional field selection and transport settings; a {@link MalRequestOptions} merged over the instance defaults.
+   * @returns The requested {@link MalManga}.
+   * @throws A normalized `AniLinkError` when the request fails.
+   * @example
+   * ```typescript
+   * const api = new AniLink({ mal: { accessToken: "mal-token" } }).mal;
+   * const manga = await api.manga.get(1, { fields: ["id", "title"] });
+   * ```
+   * @see https://myanimelist.net/apiconfig/references/api/v2#tag/manga/operation/manga_manga_id_get
+   */
+  async get(id, options = {}) {
+    const { fields, ...transportOptions } = options;
+    return await this.execute("/manga/{id}", {
+      transportOptions,
+      query: fields === void 0 ? void 0 : { fields: Array.isArray(fields) ? fields.join(",") : fields },
+      pathParams: { id }
+    });
+  }
+  /**
+   * Encodes a {@link MalMangaListStatusUpdate} as the form-urlencoded body
+   * MAL's list-status endpoints require.
+   *
+   * MAL documents `PATCH /manga/{id}/my_list_status` with an
+   * `application/x-www-form-urlencoded` request body, not JSON. Array values
+   * (`tags`) are joined into the comma-separated string MAL expects.
+   *
+   * @param payload - The list-status fields to update.
+   * @returns The encoded body string, safe to pass as the request `data`.
+   */
+  encodeListStatusBody(payload) {
+    const params = new URLSearchParams();
+    for (const [key, value] of Object.entries(payload)) {
+      if (value === void 0) continue;
+      if (Array.isArray(value)) {
+        params.set(key, value.join(","));
+      } else {
+        params.set(key, String(value));
+      }
+    }
+    return params.toString();
+  }
+  /**
+   * {@link MalMangaOperation.updateMyListStatus} updates the authenticated user's manga list status.
+   *
+   * It calls `PATCH /manga/{id}/my_list_status` through `RestOperation.execute` with `requiresAuth` and a form-urlencoded {@link MalMangaListStatusUpdate} body (MAL rejects JSON on this endpoint), returning the updated {@link MalMangaListStatus}. The facade alias is `MyAnimeListMangaApi.updateMyListStatus` and it requires `MalCredentials.accessToken`.
+   *
+   * @param id - The MyAnimeList manga ID.
+   * @param payload - The list-status fields to update; a {@link MalMangaListStatusUpdate} of only the fields to change.
+   * @param options - Optional field selection and transport settings; a {@link MalRequestOptions} merged over the instance defaults.
+   * @returns The updated {@link MalMangaListStatus}.
+   * @throws An `AniLinkAuthError` without an access token, or a normalized request error.
+   * @example
+   * ```typescript
+   * const api = new AniLink({ mal: { accessToken: "mal-token" } }).mal;
+   * const status = await api.manga.updateMyListStatus(1, {
+   *   status: "reading",
+   *   num_chapters_read: 10,
+   *   score: 9,
+   * });
+   * ```
+   * @see https://myanimelist.net/apiconfig/references/api/v2#tag/user-mangalist/operation/manga_manga_id_my_list_status_put
+   */
+  async updateMyListStatus(id, payload, options = {}) {
+    const { fields, ...transportOptions } = options;
+    return await this.execute("/manga/{id}/my_list_status", {
+      method: "PATCH",
+      requiresAuth: true,
+      transportOptions,
+      contentType: "application/x-www-form-urlencoded",
+      body: this.encodeListStatusBody(payload),
+      query: fields === void 0 ? void 0 : { fields: Array.isArray(fields) ? fields.join(",") : fields },
+      pathParams: { id }
+    });
+  }
+  /**
+   * {@link MalMangaOperation.deleteFromList} removes a manga from the authenticated user's list.
+   *
+   * It calls `DELETE /manga/{id}/my_list_status` through `RestOperation.execute` with `requiresAuth` and resolves with no body. The facade alias is `MyAnimeListMangaApi.deleteFromList` and it requires `MalCredentials.accessToken`.
+   *
+   * @param id - The MyAnimeList manga ID.
+   * @param options - Optional transport settings; a {@link MalRequestOptions} merged over the instance defaults.
+   * @returns Resolves once the entry is deleted; the response carries no body.
+   * @throws An `AniLinkAuthError` without an access token, or a normalized request error.
+   * @example
+   * ```typescript
+   * const api = new AniLink({ mal: { accessToken: "mal-token" } }).mal;
+   * await api.manga.deleteFromList(1);
+   * ```
+   * @see https://myanimelist.net/apiconfig/references/api/v2#tag/user-mangalist/operation/manga_manga_id_my_list_status_delete
+   */
+  async deleteFromList(id, options = {}) {
+    const { fields: _ignoredFields, ...transportOptions } = options;
+    await this.execute("/manga/{id}/my_list_status", {
+      method: "DELETE",
+      requiresAuth: true,
+      transportOptions,
+      pathParams: { id }
+    });
   }
 }
 
@@ -7034,20 +7930,30 @@ class MalUserOperation extends RestOperation {
    */
   async me(options = {}) {
     const { fields, ...transportOptions } = options;
-    return await this.execute(
-      "/users/@me",
-      { requiresAuth: true, transportOptions },
-      fields === void 0 ? void 0 : { fields: Array.isArray(fields) ? fields.join(",") : fields }
-    );
+    return await this.execute("/users/@me", {
+      requiresAuth: true,
+      transportOptions,
+      query: fields === void 0 ? void 0 : { fields: Array.isArray(fields) ? fields.join(",") : fields }
+    });
   }
 }
 
 function buildMyAnimeListApi(credentials) {
   const { auth, options } = resolveMalCredentials(credentials);
   const anime = new MalAnimeOperation(auth, options);
+  const manga = new MalMangaOperation(auth, options);
   const user = new MalUserOperation(auth, options);
   return {
-    anime: { get: anime.get.bind(anime) },
+    anime: {
+      get: anime.get.bind(anime),
+      updateMyListStatus: anime.updateMyListStatus.bind(anime),
+      deleteFromList: anime.deleteFromList.bind(anime)
+    },
+    manga: {
+      get: manga.get.bind(manga),
+      updateMyListStatus: manga.updateMyListStatus.bind(manga),
+      deleteFromList: manga.deleteFromList.bind(manga)
+    },
     user: { me: user.me.bind(user) }
   };
 }
@@ -7062,76 +7968,84 @@ const PROVIDER_FACTORIES = {
   mal: buildMalClient
 };
 function buildProviderClients(credentials = {}, legacyOptions) {
+  const clientHookError = credentials.onHookError;
+  const anilistSlot = clientHookError !== void 0 && credentials.anilist?.onHookError === void 0 ? { ...credentials.anilist, onHookError: clientHookError } : credentials.anilist;
+  const malSlot = clientHookError !== void 0 && credentials.mal?.onHookError === void 0 ? { ...credentials.mal, onHookError: clientHookError } : credentials.mal;
   return {
-    anilist: PROVIDER_FACTORIES.anilist(credentials.anilist, legacyOptions),
-    mal: PROVIDER_FACTORIES.mal(credentials.mal)
+    anilist: PROVIDER_FACTORIES.anilist(anilistSlot, legacyOptions),
+    mal: PROVIDER_FACTORIES.mal(malSlot)
   };
 }
 
-const AUTH_TOKEN_TIMEOUT_MS = 1e4;
-const ANILIST_TOKEN_URL = "https://anilist.co/api/v2/oauth/token";
-const ANILIST_AUTHORIZE_URL = "https://anilist.co/api/v2/oauth/authorize";
-const buildAuthorizationUrl = (clientId, redirectUri, state) => {
-  let url = `${ANILIST_AUTHORIZE_URL}?client_id=${encodeURIComponent(
-    clientId
-  )}&redirect_uri=${encodeURIComponent(redirectUri)}&response_type=code`;
-  if (state !== void 0) {
-    url += `&state=${encodeURIComponent(state)}`;
+const sanitizeTokenError = (error, label) => {
+  if (error instanceof AniLinkRestError) {
+    const relabeled = new AniLinkRestError(error.status, error.data, void 0, {
+      rateLimit: error.rateLimit,
+      contentType: error.contentType,
+      requestId: error.requestId
+    });
+    relabeled.message = `${label} failed with status ${error.status}.`;
+    return relabeled;
   }
-  return url;
-};
-const normalizeTokenRequestError = (error) => {
   if (error instanceof AniLinkApiError) {
-    error.message = `Token request failed with status ${error.status}.`;
-    return error;
+    const relabeled = new AniLinkApiError(error.status, error.data, void 0, {
+      rateLimit: error.rateLimit,
+      contentType: error.contentType,
+      requestId: error.requestId
+    });
+    relabeled.message = `${label} failed with status ${error.status}.`;
+    return relabeled;
   }
   if (error instanceof AniLinkError) {
     return error;
   }
   if (axios.isCancel(error)) {
-    return new AniLinkNetworkError(
-      AniLinkErrorCodes.ABORTED,
-      "The token request was cancelled."
-    );
+    return new AniLinkNetworkError(AniLinkErrorCodes.ABORTED, `${label} was cancelled.`);
   }
   if (axios.isAxiosError(error)) {
     if (error.response?.status !== void 0) {
       const status = error.response.status;
       const apiError = new AniLinkApiError(status, error.response.data);
-      apiError.message = `Token request failed with status ${status}.`;
+      apiError.message = `${label} failed with status ${status}.`;
       return apiError;
     }
     if (error.code === "ECONNABORTED" || error.code === "ETIMEDOUT") {
-      return new AniLinkNetworkError(
-        AniLinkErrorCodes.TIMEOUT,
-        "The token request timed out."
-      );
+      return new AniLinkNetworkError(AniLinkErrorCodes.TIMEOUT, `${label} timed out.`);
     }
     return new AniLinkNetworkError(
       AniLinkErrorCodes.NETWORK,
-      "The token request failed due to a network error."
+      `${label} failed due to a network error.`
     );
   }
-  return new AniLinkError("The token request failed.", AniLinkErrorCodes.UNKNOWN);
+  return new AniLinkError(`${label} failed.`, AniLinkErrorCodes.UNKNOWN);
+};
+
+const AUTH_TOKEN_TIMEOUT_MS = 1e4;
+const ANILIST_TOKEN_URL = "https://anilist.co/api/v2/oauth/token";
+const ANILIST_AUTHORIZE_URL = "https://anilist.co/api/v2/oauth/authorize";
+const buildAuthorizationUrl = (clientId, redirectUri, state) => {
+  let url = `${ANILIST_AUTHORIZE_URL}?client_id=${encodeURIComponent(
+    clientId
+  )}&redirect_uri=${encodeURIComponent(redirectUri)}&response_type=code`;
+  if (state !== void 0) {
+    url += `&state=${encodeURIComponent(state)}`;
+  }
+  return url;
 };
+const normalizeTokenRequestError = (error) => sanitizeTokenError(error, "AniList token request");
 const requestToken = async (params, signal) => {
   const options = {
-    // Token exchanges block the login flow, so they fail faster than
-    // GraphQL operations unless the caller tunes the timeout explicitly.
     timeout: AUTH_TOKEN_TIMEOUT_MS,
-    signal
+    signal,
+    exposeRawAxiosError: false
   };
   try {
-    return await sendRequest(
-      ANILIST_TOKEN_URL,
-      "POST",
-      new URLSearchParams(params).toString(),
-      void 0,
-      false,
+    const body = new URLSearchParams(params).toString();
+    return await sendRequest(ANILIST_TOKEN_URL, "POST", body, void 0, {
+      requiresAuth: false,
       options,
-      void 0,
-      "application/x-www-form-urlencoded"
-    );
+      contentType: "application/x-www-form-urlencoded"
+    });
   } catch (error) {
     throw normalizeTokenRequestError(error);
   }
@@ -7157,6 +8071,171 @@ const refreshAccessToken = async (clientId, clientSecret, refreshToken, signal)
 );
 const getTokenExpiry = (response, now = Date.now()) => new Date(now + response.expires_in * 1e3);
 
+const isPlainObject = (value) => {
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+};
+const stableStringify = (value, seen = /* @__PURE__ */ new Set()) => {
+  if (value === null || typeof value !== "object") {
+    return JSON.stringify(value) ?? "undefined";
+  }
+  if (seen.has(value)) {
+    return '"[Circular]"';
+  }
+  seen.add(value);
+  try {
+    if (Array.isArray(value)) {
+      return `[${value.map((item) => stableStringify(item, seen)).join(",")}]`;
+    }
+    if (!isPlainObject(value)) {
+      return JSON.stringify(value) ?? "undefined";
+    }
+    const keys = Object.keys(value).sort();
+    return `{${keys.map(
+      (key) => `${JSON.stringify(key)}:${stableStringify(value[key], seen)}`
+    ).join(",")}}`;
+  } finally {
+    seen.delete(value);
+  }
+};
+class ResponseCache {
+  entries = /* @__PURE__ */ new Map();
+  ttlMs;
+  maxEntries;
+  /**
+   * Creates a response cache.
+   *
+   * @param options - Cache configuration; `ttlMs` defaults to 60_000, `maxEntries` to 128.
+   */
+  constructor(options) {
+    const rawTtl = options?.ttlMs ?? 6e4;
+    if (!Number.isFinite(rawTtl) || rawTtl < 0) {
+      throw new TypeError("ttlMs must be a finite, non-negative number");
+    }
+    this.ttlMs = rawTtl;
+    const rawMax = options?.maxEntries ?? 128;
+    if (!Number.isFinite(rawMax) || rawMax <= 0 || !Number.isInteger(rawMax)) {
+      throw new TypeError("maxEntries must be a finite, positive integer");
+    }
+    this.maxEntries = rawMax;
+  }
+  /**
+   * Builds the cache key for a request.
+   *
+   * The serialized body is SHA-256 hashed (truncated to 16 hex chars)
+   * before it enters the key, so a credential-bearing GET body is never
+   * duplicated into the key string in plaintext — the key map retains
+   * entries for up to the TTL, outliving the error paths the rest of the
+   * library scrubs. The hash is deterministic, so equal bodies still share
+   * one entry and different bodies still get different entries.
+   *
+   * @param method - The HTTP method.
+   * @param url - The request URL.
+   * @param data - The request body, when present.
+   * @param authKey - An authentication-safe credential identity, so cached
+   * responses never cross bearer-token identities.
+   * @returns The cache key.
+   */
+  static buildKey(method, url, data, authKey) {
+    const body = data === void 0 ? "none" : `sha256:${createHash("sha256").update(stableStringify(data)).digest("hex").slice(0, 16)}`;
+    return `${method}:${url}:${body}:${authKey ?? "none"}`;
+  }
+  /**
+   * Reads a cached response for the given request, or `undefined` when the
+   * entry is absent or expired. Expired entries are evicted on read. The
+   * returned value is a deep clone of the cached entry, so a caller that
+   * mutates it cannot corrupt the cached copy or affect subsequent reads.
+   *
+   * @param method - The HTTP method.
+   * @param url - The request URL.
+   * @param data - The request body, when present.
+   * @param authKey - An authentication-safe credential identity, so cached
+   * responses never cross bearer-token identities.
+   * @returns A deep clone of the cached response body, or `undefined`.
+   */
+  get(method, url, data, authKey) {
+    const key = ResponseCache.buildKey(method, url, data, authKey);
+    const entry = this.entries.get(key);
+    if (entry === void 0) {
+      return void 0;
+    }
+    if (Date.now() >= entry.expiresAt) {
+      this.entries.delete(key);
+      return void 0;
+    }
+    this.entries.delete(key);
+    this.entries.set(key, entry);
+    return structuredClone(entry.data);
+  }
+  /**
+   * Stores a response in the cache, evicting the LRU entry when the cap is
+   * reached. Only `GET` responses are cached; other methods are no-ops.
+   * The value is deep-copied on write; the cache never aliases the
+   * caller's object.
+   *
+   * @param method - The HTTP method.
+   * @param url - The request URL.
+   * @param data - The request body, when present.
+   * @param authKey - An authentication-safe credential identity, so cached
+   * responses never cross bearer-token identities.
+   * @param response - The response body to cache.
+   */
+  set(method, url, data, authKey, response) {
+    if (method !== "GET") return;
+    const key = ResponseCache.buildKey(method, url, data, authKey);
+    let snapshot;
+    try {
+      snapshot = structuredClone(response);
+    } catch {
+      return;
+    }
+    if (this.entries.has(key)) {
+      this.entries.delete(key);
+    } else if (this.entries.size >= this.maxEntries) {
+      this.evictLru();
+    }
+    this.entries.set(key, {
+      data: snapshot,
+      expiresAt: Date.now() + this.ttlMs
+    });
+  }
+  /**
+   * Removes the cached entry for the given request, if present. Use this
+   * for targeted invalidation after a mutation that changes the resource
+   * (for example a `POST` that updates the entity a cached `GET` returned).
+   * Only `GET` entries are tracked, so non-`GET` methods are a no-op and
+   * return `false`.
+   *
+   * @param method - The HTTP method.
+   * @param url - The request URL.
+   * @param data - The request body, when present.
+   * @param authKey - An authentication-safe credential identity, so cached
+   * responses never cross bearer-token identities.
+   * @returns `true` when an entry was removed, `false` when it was absent
+   *          or the method is not cached.
+   */
+  delete(method, url, data, authKey) {
+    if (method !== "GET") return false;
+    const key = ResponseCache.buildKey(method, url, data, authKey);
+    return this.entries.delete(key);
+  }
+  /**
+   * Evicts the least-recently-used entry.
+   */
+  evictLru() {
+    const oldestKey = this.entries.keys().next().value;
+    if (oldestKey !== void 0) {
+      this.entries.delete(oldestKey);
+    }
+  }
+  /**
+   * Clears all cached entries.
+   */
+  clear() {
+    this.entries.clear();
+  }
+}
+
 const MAL_AUTH_TIMEOUT_MS = 1e4;
 const buildMalAuthorizationUrl = (clientId, codeChallenge, state) => {
   const params = new URLSearchParams({
@@ -7168,53 +8247,19 @@ const buildMalAuthorizationUrl = (clientId, codeChallenge, state) => {
   if (state !== void 0) params.set("state", state);
   return `${MAL_AUTHORIZE_URL}?${params.toString().replaceAll("+", "%20")}`;
 };
-const normalizeMalTokenError = (error) => {
-  if (error instanceof AniLinkApiError) {
-    error.message = `MAL token request failed with status ${error.status}.`;
-    return error;
-  }
-  if (error instanceof AniLinkError) return error;
-  if (axios.isCancel(error)) {
-    return new AniLinkNetworkError(
-      AniLinkErrorCodes.ABORTED,
-      "The MAL token request was cancelled."
-    );
-  }
-  if (axios.isAxiosError(error)) {
-    if (error.response?.status !== void 0) {
-      const apiError = new AniLinkApiError(error.response.status, error.response.data);
-      apiError.message = `MAL token request failed with status ${error.response.status}.`;
-      return apiError;
-    }
-    if (error.code === "ECONNABORTED" || error.code === "ETIMEDOUT") {
-      return new AniLinkNetworkError(
-        AniLinkErrorCodes.TIMEOUT,
-        "The MAL token request timed out."
-      );
-    }
-    return new AniLinkNetworkError(
-      AniLinkErrorCodes.NETWORK,
-      "The MAL token request failed due to a network error."
-    );
-  }
-  return new AniLinkError("The MAL token request failed.", AniLinkErrorCodes.UNKNOWN);
-};
+const normalizeMalTokenError = (error) => sanitizeTokenError(error, "MAL token request");
 const requestMalToken = async (params, options) => {
   try {
-    return await sendRequest(
-      MAL_TOKEN_URL,
-      "POST",
-      new URLSearchParams(params).toString(),
-      void 0,
-      false,
-      {
+    const body = new URLSearchParams(params).toString();
+    return await sendRequest(MAL_TOKEN_URL, "POST", body, void 0, {
+      requiresAuth: false,
+      options: {
         ...options,
         timeout: options?.timeout ?? MAL_AUTH_TIMEOUT_MS,
         exposeRawAxiosError: false
       },
-      void 0,
-      "application/x-www-form-urlencoded"
-    );
+      contentType: "application/x-www-form-urlencoded"
+    });
   } catch (error) {
     throw normalizeMalTokenError(error);
   }
@@ -7295,4 +8340,4 @@ class AniLink {
   }
 }
 
-export { ANILIST_AUTHORIZE_URL, ANILIST_TOKEN_URL, AniLink, AniLinkApiError, AniLinkAuthError, AniLinkError, AniLinkErrorCodes, AniLinkGraphQLError, AniLinkNetworkError, AniLinkRestError, AniLinkValidationError, MAL_API_BASE_URL, MAL_API_REFERENCE, MAL_AUTHORIZE_URL, MAL_TOKEN_URL, buildAuthorizationUrl, buildMalAuthorizationUrl, buildMyAnimeListApi, buildProviderClients, getAccessToken, getMalAccessToken, getMalTokenExpiry, getTokenExpiry, paginate, paginateChunks, paginatePages, refreshAccessToken, refreshMalAccessToken };
+export { ANILIST_AUTHORIZE_URL, ANILIST_TOKEN_URL, AniLink, AniLinkApiError, AniLinkAuthError, AniLinkError, AniLinkErrorCodes, AniLinkGraphQLError, AniLinkNetworkError, AniLinkRestError, AniLinkValidationError, MAL_API_BASE_URL, MAL_API_REFERENCE, MAL_AUTHORIZE_URL, MAL_TOKEN_URL, ResponseCache, buildAuthorizationUrl, buildMalAuthorizationUrl, buildMyAnimeListApi, buildProviderClients, destroyCachedAgents, getAccessToken, getMalAccessToken, getMalTokenExpiry, getTokenExpiry, paginate, paginateChunks, paginatePages, refreshAccessToken, refreshMalAccessToken };