auth0 7.5.0 → 7.7.0

package/dist/esm/management/api/types/types.mjs

@@ -756,6 +756,18 @@ export const OauthScope = {
     /**
      * Delete Organization Client Associations */
     DeleteOrganizationClients: "delete:organization_clients",
+    /**
+     * Create Universal Portals */
+    CreatePortals: "create:portals",
+    /**
+     * Read Universal Portals */
+    ReadPortals: "read:portals",
+    /**
+     * Update Universal Portals */
+    UpdatePortals: "update:portals",
+    /**
+     * Delete Universal Portals */
+    DeletePortals: "delete:portals",
     /**
      * Create Network ACL Keys */
     CreateNetworkAclKeys: "create:network_acl_keys",
@@ -778,6 +790,12 @@ export var TooManyRequestsErrorBody;
         TooManyRequests: "Too Many Requests",
     };
 })(TooManyRequestsErrorBody || (TooManyRequestsErrorBody = {}));
+export var InternalServerErrorBody;
+(function (InternalServerErrorBody) {
+    InternalServerErrorBody.Error_ = {
+        InternalServerError: "Internal Server Error",
+    };
+})(InternalServerErrorBody || (InternalServerErrorBody = {}));
 /** How the action is being referred to: `action_id` or `action_name`. */
 export const ActionBindingRefTypeEnum = {
     BindingId: "binding_id",
@@ -1059,16 +1077,6 @@ export const BruteForceProtectionShieldsEnum = {
     Block: "block",
     UserNotification: "user_notification",
 };
-/** The CAPTCHA provider type. */
-export const CaptchaActiveProviderEnum = {
-    SimpleCaptcha: "simple_captcha",
-    AuthChallenge: "auth_challenge",
-    RecaptchaV2: "recaptcha_v2",
-    RecaptchaEnterprise: "recaptcha_enterprise",
-    Hcaptcha: "hcaptcha",
-    FriendlyCaptcha: "friendly_captcha",
-    Arkose: "arkose",
-};
 export const CertificateSubjectDnCredentialTypeEnum = {
     CertSubjectDn: "cert_subject_dn",
 };
@@ -1261,6 +1269,13 @@ export const ClientProfileApplyPolicyExternalMetadataCreatedByEnum = {
 export const ClientProfileApplyPolicyExternalMetadataTypeEnum = {
     Cimd: "cimd",
 };
+/** Optional OIDC scope that matched clients may be granted. */
+export const ClientProfileClientConfigurationOidcSupportAllowedScopesEnum = {
+    Profile: "profile",
+    Email: "email",
+    Address: "address",
+    Phone: "phone",
+};
 /** A method used to discover a user's organization. */
 export const ClientProfileClientConfigurationOrganizationDiscoveryMethodEnum = {
     Email: "email",
@@ -1984,7 +1999,7 @@ export const ConnectionTokenEndpointAuthSigningAlgEnum = {
     Rs384: "RS384",
     Rs512: "RS512",
 };
-/** Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the OIDC issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL). */
+/** Specifies the format of the aud (audience) claim included in the JWT used for client authentication at the token endpoint. Accepted values are: 'issuer' (the aud claim is set to the identity provider's issuer URL) or 'token_endpoint' (the aud claim is set to the token endpoint URL). */
 export const ConnectionTokenEndpointJwtcaAudFormatEnumOidc = {
     Issuer: "issuer",
     TokenEndpoint: "token_endpoint",
@@ -4231,6 +4246,36 @@ export const EventStreamCloudEventConnectionUpdatedPreviousObject7StrategyEnum =
 export const EventStreamCloudEventConnectionUpdatedTypeEnum = {
     ConnectionUpdated: "connection.updated",
 };
+/** The protocol used for this transaction. */
+export const EventStreamCloudEventContextTransactionProtocolEnum = {
+    OidcBasicProfile: "oidc-basic-profile",
+    OidcImplicitProfile: "oidc-implicit-profile",
+    Oauth2DeviceCode: "oauth2-device-code",
+    Oauth2ResourceOwner: "oauth2-resource-owner",
+    Oauth2ResourceOwnerJwtBearer: "oauth2-resource-owner-jwt-bearer",
+    Oauth2Password: "oauth2-password",
+    Oauth2Webauthn: "oauth2-webauthn",
+    Oauth2AccessToken: "oauth2-access-token",
+    Oauth2RefreshToken: "oauth2-refresh-token",
+    Oauth2TokenExchange: "oauth2-token-exchange",
+    OidcHybridProfile: "oidc-hybrid-profile",
+    Samlp: "samlp",
+    Wsfed: "wsfed",
+    WstrustUsernamemixed: "wstrust-usernamemixed",
+};
+/** This transaction's method for returning parameters from the Authorization Endpoint. */
+export const EventStreamCloudEventContextTransactionResponseModeEnum = {
+    Query: "query",
+    Fragment: "fragment",
+    FormPost: "form_post",
+    WebMessage: "web_message",
+};
+/** OAuth/OIDC response types. */
+export const EventStreamCloudEventContextTransactionResponseTypeItemEnum = {
+    Code: "code",
+    Token: "token",
+    IdToken: "id_token",
+};
 /** Machine-readable error code. */
 export const EventStreamCloudEventErrorCodeEnum = {
     InvalidCursor: "invalid_cursor",
@@ -6352,7 +6397,7 @@ export const GuardianEnrollmentStatus = {
     Pending: "pending",
     Confirmed: "confirmed",
 };
-/** Factor name. Can be `sms`, `push-notification`, `email`, `duo` `otp` `webauthn-roaming`, `webauthn-platform`, or `recovery-code`. */
+/** Factor name. Can be `sms`, `push-notification`, `email`, `duo`, `otp`, `webauthn-roaming`, `webauthn-platform`, `recovery-code`, or `passkey`. */
 export const GuardianFactorNameEnum = {
     PushNotification: "push-notification",
     Sms: "sms",
@@ -6362,6 +6407,7 @@ export const GuardianFactorNameEnum = {
     WebauthnRoaming: "webauthn-roaming",
     WebauthnPlatform: "webauthn-platform",
     RecoveryCode: "recovery-code",
+    Passkey: "passkey",
 };
 export const GuardianFactorPhoneFactorMessageTypeEnum = {
     Sms: "sms",
@@ -6716,6 +6762,23 @@ export const OrganizationUsageEnum = {
     Allow: "allow",
     Require: "require",
 };
+/** Horizontal alignment of the image within its container. */
+export const Position = {
+    Left: "left",
+    Center: "center",
+    Right: "right",
+};
+/** Controls the section container style. */
+export const PageComponentAuth0StructureSectionVariantEnum = {
+    Card: "card",
+    None: "none",
+};
+/** Controls the line style. Defaults to "solid". */
+export const PageComponentAuth0StructureSeparatorVariantEnum = {
+    Dashed: "dashed",
+    None: "none",
+    Solid: "solid",
+};
 /** Name of the prompt. */
 export const PartialGroupsEnum = {
     Login: "login",
@@ -6786,6 +6849,18 @@ export const PhoneTemplateNotificationTypeEnum = {
     BlockedAccount: "blocked_account",
     PasswordBreach: "password_breach",
 };
+export var PortalClientSecretPost;
+(function (PortalClientSecretPost) {
+    PortalClientSecretPost.TokenEndpointAuthMethod = {
+        ClientSecretPost: "client_secret_post",
+    };
+})(PortalClientSecretPost || (PortalClientSecretPost = {}));
+export var PortalClientSecretPostRequest;
+(function (PortalClientSecretPostRequest) {
+    PortalClientSecretPostRequest.TokenEndpointAuthMethod = {
+        ClientSecretPost: "client_secret_post",
+    };
+})(PortalClientSecretPostRequest || (PortalClientSecretPostRequest = {}));
 /** Selected Signing Algorithm */
 export const PostConnectionKeysAlgEnum = {
     Rs256: "RS256",
@@ -6954,6 +7029,16 @@ export const RefreshTokenRotationTypeEnum = {
     Rotating: "rotating",
     NonRotating: "non-rotating",
 };
+/** Controls whether access tokens issued for this API include agent subject claims. With <code>auth0-v1</code>, access tokens include additional claims that identify whether the subject is a <code>user</code>, <code>service</code>, or <code>ai_agent</code>. The <code>sub</code> claim can reference an agent ID, and the <code>@clients</code> suffix is no longer appended to client IDs. With <code>off</code>, these claims are not included and the <code>@clients</code> suffix is still appended. When not set, the API behaves as <code>off</code>. */
+export const ResourceServerAgentSubjectClaimsResponseEnum = {
+    Off: "off",
+    Auth0V1: "auth0-v1",
+};
+/** Controls whether access tokens issued for this API include agent subject claims. With <code>auth0-v1</code>, access tokens include additional claims that identify whether the subject is a <code>user</code>, <code>service</code>, or <code>ai_agent</code>. The <code>sub</code> claim can reference an agent ID, and the <code>@clients</code> suffix is no longer appended to client IDs. With <code>off</code>, these claims are not included and the <code>@clients</code> suffix is still appended. When not set, the API behaves as <code>off</code>. */
+export const ResourceServerAgentSubjectClaimsSchemaEnum = {
+    Off: "off",
+    Auth0V1: "auth0-v1",
+};
 export const ResourceServerConsentPolicyEnum = {
     TransactionalAuthorizationWithMfa: "transactional-authorization-with-mfa",
 };
@@ -7013,6 +7098,10 @@ export const ResourceServerTokenEncryptionAlgorithmEnum = {
 export const ResourceServerTokenEncryptionFormatEnum = {
     CompactNestedJwe: "compact-nested-jwe",
 };
+/** The type of the resource server. */
+export const ResourceServerTypeEnum = {
+    UniversalCommerceProtocolServer: "universal_commerce_protocol_server",
+};
 /** The type of the role */
 export const RoleTypeEnum = {
     Tenant: "tenant",
@@ -7133,6 +7222,7 @@ export const SearchParserEnum = {
     Scim: "scim",
     Lucene: "lucene",
 };
+/** Filter by status. Exact match. */
 export const SegmentStatusEnum = {
     Active: "active",
     Archived: "archived",

package/dist/esm/management/core/fetcher/Fetcher.mjs

@@ -14,11 +14,13 @@ import { EndpointSupplier } from "./EndpointSupplier.mjs";
 import { getErrorResponseBody } from "./getErrorResponseBody.mjs";
 import { getFetchFn } from "./getFetchFn.mjs";
 import { getRequestBody } from "./getRequestBody.mjs";
-import { getResponseBody } from "./getResponseBody.mjs";
+import { getResponseBody, isResponseBodyError } from "./getResponseBody.mjs";
 import { Headers } from "./Headers.mjs";
-import { makeRequest } from "./makeRequest.mjs";
+import { clearResponseTimeout, makeRequest } from "./makeRequest.mjs";
 import { abortRawResponse, toRawResponse, unknownRawResponse } from "./RawResponse.mjs";
+import { redactUrl, SENSITIVE_QUERY_PARAMS } from "./redactUrl.mjs";
 import { requestWithRetries } from "./requestWithRetries.mjs";
+import { TIMEOUT } from "./signals.mjs";
 const SENSITIVE_HEADERS = new Set([
     "authorization",
     "www-authenticate",
@@ -49,26 +51,6 @@ function redactHeaders(headers) {
     }
     return filtered;
 }
-const SENSITIVE_QUERY_PARAMS = new Set([
-    "api_key",
-    "api-key",
-    "apikey",
-    "token",
-    "access_token",
-    "access-token",
-    "auth_token",
-    "auth-token",
-    "password",
-    "passwd",
-    "secret",
-    "api_secret",
-    "api-secret",
-    "apisecret",
-    "key",
-    "session",
-    "session_id",
-    "session-id",
-]);
 function redactQueryParameters(queryParameters) {
     if (queryParameters == null) {
         return undefined;
@@ -79,70 +61,6 @@ function redactQueryParameters(queryParameters) {
     }
     return redacted;
 }
-function redactUrl(url) {
-    const protocolIndex = url.indexOf("://");
-    if (protocolIndex === -1)
-        return url;
-    const afterProtocol = protocolIndex + 3;
-    // Find the first delimiter that marks the end of the authority section
-    const pathStart = url.indexOf("/", afterProtocol);
-    let queryStart = url.indexOf("?", afterProtocol);
-    let fragmentStart = url.indexOf("#", afterProtocol);
-    const firstDelimiter = Math.min(pathStart === -1 ? url.length : pathStart, queryStart === -1 ? url.length : queryStart, fragmentStart === -1 ? url.length : fragmentStart);
-    // Find the LAST @ before the delimiter (handles multiple @ in credentials)
-    let atIndex = -1;
-    for (let i = afterProtocol; i < firstDelimiter; i++) {
-        if (url[i] === "@") {
-            atIndex = i;
-        }
-    }
-    if (atIndex !== -1) {
-        url = `${url.slice(0, afterProtocol)}[REDACTED]@${url.slice(atIndex + 1)}`;
-    }
-    // Recalculate queryStart since url might have changed
-    queryStart = url.indexOf("?");
-    if (queryStart === -1)
-        return url;
-    fragmentStart = url.indexOf("#", queryStart);
-    const queryEnd = fragmentStart !== -1 ? fragmentStart : url.length;
-    const queryString = url.slice(queryStart + 1, queryEnd);
-    if (queryString.length === 0)
-        return url;
-    // FAST PATH: Quick check if any sensitive keywords present
-    // Using indexOf is faster than regex for simple substring matching
-    const lower = queryString.toLowerCase();
-    const hasSensitive = lower.includes("token") ||
-        lower.includes("key") ||
-        lower.includes("password") ||
-        lower.includes("passwd") ||
-        lower.includes("secret") ||
-        lower.includes("session") ||
-        lower.includes("auth");
-    if (!hasSensitive) {
-        return url;
-    }
-    // SLOW PATH: Parse and redact
-    const redactedParams = [];
-    const params = queryString.split("&");
-    for (const param of params) {
-        const equalIndex = param.indexOf("=");
-        if (equalIndex === -1) {
-            redactedParams.push(param);
-            continue;
-        }
-        const key = param.slice(0, equalIndex);
-        let shouldRedact = SENSITIVE_QUERY_PARAMS.has(key.toLowerCase());
-        if (!shouldRedact && key.includes("%")) {
-            try {
-                const decodedKey = decodeURIComponent(key);
-                shouldRedact = SENSITIVE_QUERY_PARAMS.has(decodedKey.toLowerCase());
-            }
-            catch (_a) { }
-        }
-        redactedParams.push(shouldRedact ? `${key}=[REDACTED]` : param);
-    }
-    return url.slice(0, queryStart + 1) + redactedParams.join("&") + url.slice(queryEnd);
-}
 function getHeaders(args) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a;
@@ -174,6 +92,11 @@ function getHeaders(args) {
         return newHeaders;
     });
 }
+function isJsonContentType(contentType) {
+    var _a, _b;
+    const mediaType = (_b = (_a = contentType === null || contentType === void 0 ? void 0 : contentType.split(";")[0]) === null || _a === void 0 ? void 0 : _a.trim().toLowerCase()) !== null && _b !== void 0 ? _b : "";
+    return mediaType === "application/json" || mediaType === "text/json" || mediaType.endsWith("+json");
+}
 export function fetcherImpl(args) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a, _b, _c;
@@ -201,10 +124,19 @@ export function fetcherImpl(args) {
             };
             logger.debug("Making HTTP request", metadata);
         }
+        // Bodies that are read in full here stay covered by the timeout; streamed bodies are read by the caller.
+        const keepTimeoutUntilBodyRead = args.responseType !== "streaming" && args.responseType !== "sse" && args.responseType !== "binary-response";
+        const attemptResponses = [];
         try {
             const response = yield requestWithRetries(() => __awaiter(this, void 0, void 0, function* () {
-                return makeRequest(fetchFn, url, args.method, headers, requestBody, args.timeoutMs, args.abortSignal, args.withCredentials, args.duplex, args.responseType === "streaming" || args.responseType === "sse");
-            }), args.maxRetries);
+                // A retry means the previous attempt is over; stop its timer now rather than at the end.
+                for (const previousResponse of attemptResponses) {
+                    clearResponseTimeout(previousResponse);
+                }
+                const attemptResponse = yield makeRequest(fetchFn, url, args.method, headers, requestBody, args.timeoutMs, args.abortSignal, args.withCredentials, args.duplex, args.responseType === "streaming" || args.responseType === "sse", keepTimeoutUntilBodyRead);
+                attemptResponses.push(attemptResponse);
+                return attemptResponse;
+            }), args.maxRetries, args.abortSignal);
             if (response.status >= 200 && response.status < 400) {
                 if (logger.isDebug()) {
                     const metadata = {
@@ -216,6 +148,16 @@ export function fetcherImpl(args) {
                     logger.debug("HTTP request succeeded", metadata);
                 }
                 const body = yield getResponseBody(response, args.responseType);
+                // Only a body the server labelled as JSON is an error here; void endpoints may return plain text.
+                if (isResponseBodyError(body) &&
+                    body.error.reason === "non-json" &&
+                    isJsonContentType(response.headers.get("Content-Type"))) {
+                    return {
+                        ok: false,
+                        error: body.error,
+                        rawResponse: toRawResponse(response),
+                    };
+                }
                 return {
                     ok: true,
                     body: body,
@@ -263,7 +205,7 @@ export function fetcherImpl(args) {
                     rawResponse: abortRawResponse,
                 };
             }
-            else if (error instanceof Error && error.name === "AbortError") {
+            else if (error === TIMEOUT || (error instanceof Error && error.name === "AbortError")) {
                 if (logger.isError()) {
                     const metadata = {
                         method: args.method,
@@ -318,6 +260,11 @@ export function fetcherImpl(args) {
                 rawResponse: unknownRawResponse,
             };
         }
+        finally {
+            for (const attemptResponse of attemptResponses) {
+                clearResponseTimeout(attemptResponse);
+            }
+        }
     });
 }
 export const fetcher = fetcherImpl;

package/dist/esm/management/core/fetcher/getErrorResponseBody.mjs

@@ -8,13 +8,29 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 import { fromJson } from "../json.mjs";
-import { getResponseBody } from "./getResponseBody.mjs";
+import { getResponseBody, isResponseBodyError } from "./getResponseBody.mjs";
+/** Parses a JSON error body, falling back to the raw text so the status and body are never lost. */
+function parseJsonErrorBody(text) {
+    if (text.length === 0) {
+        return undefined;
+    }
+    try {
+        return fromJson(text);
+    }
+    catch (_a) {
+        return text;
+    }
+}
 export function getErrorResponseBody(response) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a, _b, _c;
         let contentType = (_a = response.headers.get("Content-Type")) === null || _a === void 0 ? void 0 : _a.toLowerCase();
         if (contentType == null || contentType.length === 0) {
-            return getResponseBody(response);
+            const body = yield getResponseBody(response);
+            if (isResponseBodyError(body)) {
+                return body.error.reason === "non-json" ? body.error.rawBody : undefined;
+            }
+            return body;
         }
         if (contentType.indexOf(";") !== -1) {
             contentType = (_c = (_b = contentType.split(";")[0]) === null || _b === void 0 ? void 0 : _b.trim()) !== null && _c !== void 0 ? _c : "";
@@ -25,14 +41,11 @@ export function getErrorResponseBody(response) {
             case "application/ld+json":
             case "application/problem+json":
             case "application/vnd.api+json":
-            case "text/json": {
-                const text = yield response.text();
-                return text.length > 0 ? fromJson(text) : undefined;
-            }
+            case "text/json":
+                return parseJsonErrorBody(yield response.text());
             default:
                 if (contentType.startsWith("application/vnd.") && contentType.endsWith("+json")) {
-                    const text = yield response.text();
-                    return text.length > 0 ? fromJson(text) : undefined;
+                    return parseJsonErrorBody(yield response.text());
                 }
                 // Fallback to plain text if content type is not recognized
                 // Even if no body is present, the response will be an empty string

package/dist/esm/management/core/fetcher/getResponseBody.d.mts

@@ -1 +1,17 @@
+export type ResponseBodyError = {
+    ok: false;
+    error: {
+        reason: "non-json";
+        statusCode: number;
+        rawBody: string;
+    } | {
+        reason: "body-is-null";
+        statusCode: number;
+    };
+};
+/**
+ * Returns true when `value` is a failure record created by `getResponseBody` (for example malformed JSON),
+ * as opposed to a parsed JSON body that happens to have the same shape.
+ */
+export declare function isResponseBodyError(value: unknown): value is ResponseBodyError;
 export declare function getResponseBody(response: Response, responseType?: string): Promise<unknown>;

package/dist/esm/management/core/fetcher/getResponseBody.mjs

@@ -18,6 +18,19 @@ function retainResponse(target, response) {
         writable: false,
     });
 }
+const responseBodyErrors = new WeakSet();
+function responseBodyError(error) {
+    const record = { ok: false, error };
+    responseBodyErrors.add(record);
+    return record;
+}
+/**
+ * Returns true when `value` is a failure record created by `getResponseBody` (for example malformed JSON),
+ * as opposed to a parsed JSON body that happens to have the same shape.
+ */
+export function isResponseBodyError(value) {
+    return typeof value === "object" && value != null && responseBodyErrors.has(value);
+}
 export function getResponseBody(response, responseType) {
     return __awaiter(this, void 0, void 0, function* () {
         switch (responseType) {
@@ -29,25 +42,19 @@ export function getResponseBody(response, responseType) {
                 return yield response.arrayBuffer();
             case "sse":
                 if (response.body == null) {
-                    return {
-                        ok: false,
-                        error: {
-                            reason: "body-is-null",
-                            statusCode: response.status,
-                        },
-                    };
+                    return responseBodyError({
+                        reason: "body-is-null",
+                        statusCode: response.status,
+                    });
                 }
                 retainResponse(response.body, response);
                 return response.body;
             case "streaming":
                 if (response.body == null) {
-                    return {
-                        ok: false,
-                        error: {
-                            reason: "body-is-null",
-                            statusCode: response.status,
-                        },
-                    };
+                    return responseBodyError({
+                        reason: "body-is-null",
+                        statusCode: response.status,
+                    });
                 }
                 retainResponse(response.body, response);
                 return response.body;
@@ -62,14 +69,11 @@ export function getResponseBody(response, responseType) {
                 return responseBody;
             }
             catch (_err) {
-                return {
-                    ok: false,
-                    error: {
-                        reason: "non-json",
-                        statusCode: response.status,
-                        rawBody: text,
-                    },
-                };
+                return responseBodyError({
+                    reason: "non-json",
+                    statusCode: response.status,
+                    rawBody: text,
+                });
             }
         }
         return undefined;

package/dist/esm/management/core/fetcher/makePassthroughRequest.mjs

@@ -12,7 +12,9 @@ import { join } from "../url/join.mjs";
 import { EndpointSupplier } from "./EndpointSupplier.mjs";
 import { getFetchFn } from "./getFetchFn.mjs";
 import { makeRequest } from "./makeRequest.mjs";
+import { redactUrl } from "./redactUrl.mjs";
 import { requestWithRetries } from "./requestWithRetries.mjs";
+import { TIMEOUT } from "./signals.mjs";
 import { Supplier } from "./Supplier.mjs";
 /**
  * Makes a passthrough HTTP request using the SDK's configuration (auth, retry, logging, etc.)
@@ -76,8 +78,10 @@ export function makePassthroughRequest(input, init, clientOptions, requestOption
                 }
             }
         }
-        // Apply auth headers
-        if (clientOptions.getAuthHeaders != null) {
+        // Apply auth headers, but only when the resolved URL targets the configured base URL.
+        // This prevents the SDK's credentials from leaking to an unrelated host when a caller
+        // passes an absolute cross-origin URL into the passthrough fetch escape hatch.
+        if (clientOptions.getAuthHeaders != null && targetsBaseUrl(fullUrl, baseUrl)) {
             const authHeaders = yield clientOptions.getAuthHeaders();
             for (const [key, value] of Object.entries(authHeaders)) {
                 mergedHeaders[key.toLowerCase()] = value;
@@ -112,21 +116,55 @@ export function makePassthroughRequest(input, init, clientOptions, requestOption
         if (logger.isDebug()) {
             logger.debug("Making passthrough HTTP request", {
                 method,
-                url: fullUrl,
+                url: redactUrl(fullUrl),
                 hasBody: body != null,
             });
         }
-        const response = yield requestWithRetries(() => __awaiter(this, void 0, void 0, function* () {
-            return makeRequest(fetchFn, fullUrl, method, mergedHeaders, body !== null && body !== void 0 ? body : undefined, timeoutMs, abortSignal, (effectiveInit === null || effectiveInit === void 0 ? void 0 : effectiveInit.credentials) === "include", undefined, // duplex
-            false);
-        }), maxRetries);
+        let response;
+        try {
+            response = yield requestWithRetries(() => __awaiter(this, void 0, void 0, function* () {
+                return makeRequest(fetchFn, fullUrl, method, mergedHeaders, body !== null && body !== void 0 ? body : undefined, timeoutMs, abortSignal, (effectiveInit === null || effectiveInit === void 0 ? void 0 : effectiveInit.credentials) === "include", undefined, // duplex
+                false);
+            }), maxRetries, abortSignal);
+        }
+        catch (error) {
+            // Match `fetch`: a timeout rejects with an Error named "TimeoutError", not the bare abort reason.
+            if (error === TIMEOUT) {
+                throw createTimeoutError();
+            }
+            throw error;
+        }
         if (logger.isDebug()) {
             logger.debug("Passthrough HTTP request completed", {
                 method,
-                url: fullUrl,
+                url: redactUrl(fullUrl),
                 statusCode: response.status,
             });
         }
         return response;
     });
 }
+function createTimeoutError() {
+    const error = new Error("The request timed out.");
+    error.name = "TimeoutError";
+    return error;
+}
+/**
+ * Returns true when the resolved request URL points at the same origin as the
+ * configured base URL. Relative paths are always joined onto the base URL, so
+ * they resolve to the base origin and return true. Absolute URLs only match when
+ * their origin equals the base origin. When there is no base URL to compare
+ * against, or either value is not a parseable absolute URL, this returns false so
+ * auth headers are not attached.
+ */
+function targetsBaseUrl(fullUrl, baseUrl) {
+    if (baseUrl == null) {
+        return false;
+    }
+    try {
+        return new URL(fullUrl).origin === new URL(baseUrl).origin;
+    }
+    catch (_a) {
+        return false;
+    }
+}

package/dist/esm/management/core/fetcher/makeRequest.d.mts

@@ -3,4 +3,9 @@ export declare function isCacheNoStoreSupported(): boolean;
  * Reset the cached result of `isCacheNoStoreSupported`. Exposed for testing only.
  */
 export declare function resetCacheNoStoreSupported(): void;
-export declare const makeRequest: (fetchFn: (url: string, init: RequestInit) => Promise<Response>, url: string, method: string, headers: Headers | Record<string, string>, requestBody: BodyInit | undefined, timeoutMs?: number, abortSignal?: AbortSignal, withCredentials?: boolean, duplex?: "half", disableCache?: boolean) => Promise<Response>;
+/**
+ * Clears the timeout that `makeRequest` kept running (with `keepTimeoutUntilBodyRead`) so that it also
+ * covered reading the response body.
+ */
+export declare function clearResponseTimeout(response: Response): void;
+export declare const makeRequest: (fetchFn: (url: string, init: RequestInit) => Promise<Response>, url: string, method: string, headers: Headers | Record<string, string>, requestBody: BodyInit | undefined, timeoutMs?: number, abortSignal?: AbortSignal, withCredentials?: boolean, duplex?: "half", disableCache?: boolean, keepTimeoutUntilBodyRead?: boolean) => Promise<Response>;