cartethyia 2.8.0 → 2.8.1

package/src/network/pool/selector.ts

@@ -22,7 +22,7 @@ import {
   proxyCooldownProvidersKey,
   proxyInflightKey,
   proxyProviderInflightKey,
-} from "./pool-scripts";
+} from "./scripts";
 import {
   advanceRotation,
   createPoolLocalState,
@@ -34,7 +34,7 @@ import {
   type PoolRotation,
   type PoolUsageSnapshot,
   type ProxyCooldownEntry,
-} from "./pool-state";
+} from "./state";
 
 export type { PoolRotation, ProxyCooldownEntry };
 

package/src/network/ssrf.ts

@@ -9,7 +9,7 @@ import {
   ipv4ToNumberStrict,
   ipv6GroupsToBytes,
   normalizeIpv6Groups,
-} from "./ip-utils";
+} from "./util/ip";
 
 const DNS_CACHE_TTL_MS = 60_000;
 const DNS_CACHE_MAX = 64;

package/src/network/{retry.ts → util/retry.ts}

@@ -7,7 +7,7 @@
  */
 
 import { exponentialBackoff, type BackoffOptions } from "./backoff";
-import { sleep as defaultSleep } from "../shared/sleep";
+import { sleep as defaultSleep } from "../../shared/sleep";
 
 interface RetryOptions {
   readonly maxRetries?: number;

package/src/observability/telemetry-buffer.ts

@@ -174,7 +174,7 @@ const DRAIN_MAX_ATTEMPTS = 5;
 const DRAIN_RETRY_BASE_MS = 25;
 const DRAIN_RETRY_MAX_MS = 1_000;
 
-import { exponentialBackoff, type BackoffOptions } from "../network/backoff";
+import { exponentialBackoff, type BackoffOptions } from "../network/util/backoff";
 
 /** Exponential retry delay for the `attempt`-th retry, clamped to the ceiling. */
 function drainRetryDelayMs(attempt: number, baseDelayMs = DRAIN_RETRY_BASE_MS): number {

package/src/persistence/schema.ts

@@ -816,6 +816,12 @@ export const providerRoutingSettings = pgTable(
     // dispatch automatically selects among every active network pool the
     // tenant owns (least-loaded/non-cooldown) — never an admin-pinned pool.
     skipProxy: boolean("skip_proxy").notNull().default(false),
+    // How device-code OAuth flows (start + poll) choose their egress:
+    // 'random' (default) routes them through a randomly selected active
+    // network pool so the upstream sees a rotating IP (avoids "multiple codes
+    // from one IP" detection for Cursor/Grok/device-code providers); 'direct'
+    // always dials direct egress.
+    deviceFlowProxy: text("device_flow_proxy").$type<DeviceFlowProxyMode>().notNull().default("random"),
   },
   (table) => ({
     tenantProviderUnique: uniqueIndex("provider_routing_settings_tenant_provider_idx").on(
@@ -835,6 +841,9 @@ export const poolRoutingStrategy = pgEnum("pool_routing_strategy", [
 ]);
 export type PoolRoutingStrategy = (typeof poolRoutingStrategy.enumValues)[number];
 
+/** Egress mode for device-code OAuth flows: random active pool, or direct. */
+export type DeviceFlowProxyMode = "random" | "direct";
+
 /**
  * Per-tenant selection strategy across the tenant's active network pools —
  * the pool-group counterpart to `provider_routing_settings`. `least_loaded`

package/src/persistence/ttl-cache.ts

@@ -1,4 +1,4 @@
-import { dedupeRequest } from "../network/deduplication";
+import { dedupeRequest } from "../network/util/dedupe";
 /**
  * Bounded TTL cache with automatic eviction.
  *

package/src/protocol/codecs.ts

@@ -91,6 +91,63 @@ export function hash32(input: string): number {
 
 const CLAUDE_TOOL_PREFIX = "_";
 
+/**
+ * Per-request tool-name rename map, mirroring the two-way alias pattern the
+ * OpenCode free-tier fingerprint uses: a caller tool whose name collides with
+ * an upstream-reserved name (or with the built-in prefix) travels under an
+ * alias, and the response side restores the caller's original name.
+ *
+ * The map is a bag of `{ sent, original }` pairs so a provider can rename at
+ * build time and restore at decode time without guessing from a fixed prefix
+ * (a fixed prefix collides when a caller already uses it — `_bash` from a
+ * caller named `bash` vs a caller already named `_bash`).
+ */
+export interface ToolNameAlias {
+  /** Name sent to the upstream wire. */
+  readonly sent: string;
+  /** Caller's original name; restore to this on the way back. */
+  readonly original: string;
+}
+
+/** Restore a sent name to the caller's original, when it was renamed. */
+export function restoreAliasedToolName(
+  sent: string,
+  aliases: ReadonlyArray<ToolNameAlias>,
+): string {
+  for (const alias of aliases) {
+    if (alias.sent === sent) return alias.original;
+  }
+  return sent;
+}
+
+/**
+ * Registry of per-request tool renames, keyed by the canonical request object
+ * (the same object the builder saw and the decoder receives). This is the
+ * transport-agnostic way to pair `encodeWireRequest` with `decodeWireResponse`
+ * without threading a new parameter through every adapter: a request records
+ * its aliases at build time, and any decoder that still has the request can
+ * restore the caller's original tool names exactly.
+ *
+ * The WeakMap keeps no lifetime: entries die with the request object.
+ */
+const toolAliasesByRequest = new WeakMap<object, readonly ToolNameAlias[]>();
+
+/** Record the rename map a request produced. Idempotent per request. */
+export function recordToolAliases(request: object, aliases: readonly ToolNameAlias[]): void {
+  if (aliases.length === 0) return;
+  toolAliasesByRequest.set(request, aliases);
+}
+
+/** Read the rename map a request recorded, if any. */
+export function toolAliasesFor(request: object): readonly ToolNameAlias[] {
+  return toolAliasesByRequest.get(request) ?? [];
+}
+
+/** Restore a tool name exactly from the request's recorded renames. */
+export function restoreToolNameFor(request: object, sent: string): string {
+  return restoreAliasedToolName(sent, toolAliasesFor(request));
+}
+
 export type ClaudeWireObject = Record<string, unknown>;
 
 /**
@@ -366,7 +423,7 @@ function sanitizeSchemaWalk(value: unknown, walk: RewriteWalk): unknown {
 
 // OAuth tool-name prefixing
 
-const ANTHROPIC_BUILTIN_TOOL_NAMES = new Set([
+export const ANTHROPIC_BUILTIN_TOOL_NAMES = new Set([
   "web_search",
   "web_fetch",
   "code_execution",

package/src/protocol/request/messages.ts

@@ -17,11 +17,13 @@ import {
   normalizeAnthropicToolCallId,
   parseArguments,
   prefixClaudeToolName,
+  recordToolAliases,
   sanitizeSchemaForAnthropic,
   stringValue,
   toWellFormedDeep,
   toWellFormedString,
   type ClaudeWireObject,
+  type ToolNameAlias,
   isRecord,
   resolveImageSource,
   splitDataUrl,
@@ -287,6 +289,7 @@ function partToClaudeBlock(
     idMap: Map<string, string>;
     isOAuth: boolean;
     imageCount: number;
+    toolAliases: ToolNameAlias[];
     maxBytesOverride?: number;
   },
 ): ClaudeWireObject | undefined {
@@ -336,10 +339,12 @@ function partToClaudeBlock(
       // stamp every call with its array position, so copying it here leaked a
       // stream-only field into a request. The position is not lost: the block
       // order in `content[]` already expresses it.
+      const sentName = prefixClaudeToolName(part.name, ctx?.isOAuth ?? false);
+      if (sentName !== part.name) ctx?.toolAliases.push({ sent: sentName, original: part.name });
       return {
         type: "tool_use",
         id: normalized,
-        name: prefixClaudeToolName(part.name, ctx?.isOAuth ?? false),
+        name: sentName,
         input: toWellFormedDeep(parseArguments(part.arguments)),
         ...(part.namespace === undefined ? {} : { namespace: part.namespace }),
       };
@@ -577,6 +582,7 @@ export function canonicalToClaudeMessagesPayload(
     idMap,
     isOAuth: options.isOAuth ?? false,
     imageCount,
+    toolAliases: [] as ToolNameAlias[],
     ...(options.maxBytesOverride === undefined
       ? {}
       : { maxBytesOverride: options.maxBytesOverride }),
@@ -755,27 +761,34 @@ export function canonicalToClaudeMessagesPayload(
       });
   }
   if (request.tools?.length) {
-    payload.tools = request.tools.map((tool) => ({
-      name: prefixClaudeToolName(tool.name, isOAuth),
-      ...(tool.description === undefined
-        ? {}
-        : { description: toWellFormedDeep(tool.description) }),
-      input_schema: sanitizeSchemaForAnthropic(tool.jsonSchema),
-      ...(tool.strict === true ? { strict: true } : {}),
-      ...(tool.eager_input_streaming === undefined
-        ? {}
-        : { eager_input_streaming: tool.eager_input_streaming }),
-      ...(tool.defer_loading === undefined
-        ? {}
-        : { defer_loading: tool.defer_loading }),
-      ...(tool.input_examples === undefined ? {} : { input_examples: tool.input_examples }),
-      ...(tool.allowed_callers === undefined ? {} : { allowed_callers: tool.allowed_callers }),
-    }));
+    payload.tools = request.tools.map((tool) => {
+      const sentName = prefixClaudeToolName(tool.name, isOAuth);
+      if (sentName !== tool.name) ctx.toolAliases.push({ sent: sentName, original: tool.name });
+      return {
+        name: sentName,
+        ...(tool.description === undefined
+          ? {}
+          : { description: toWellFormedDeep(tool.description) }),
+        input_schema: sanitizeSchemaForAnthropic(tool.jsonSchema),
+        ...(tool.strict === true ? { strict: true } : {}),
+        ...(tool.eager_input_streaming === undefined
+          ? {}
+          : { eager_input_streaming: tool.eager_input_streaming }),
+        ...(tool.defer_loading === undefined
+          ? {}
+          : { defer_loading: tool.defer_loading }),
+        ...(tool.input_examples === undefined ? {} : { input_examples: tool.input_examples }),
+        ...(tool.allowed_callers === undefined ? {} : { allowed_callers: tool.allowed_callers }),
+      };
+    });
   }
   const rawToolChoice = canonicalToolChoice(request.tool_choice);
   if (isRecord(rawToolChoice) && rawToolChoice.type === "tool" && stringValue(rawToolChoice.name)) {
-    rawToolChoice.name = prefixClaudeToolName(rawToolChoice.name, isOAuth);
+    const sentName = prefixClaudeToolName(rawToolChoice.name, isOAuth);
+    if (sentName !== rawToolChoice.name) ctx.toolAliases.push({ sent: sentName, original: rawToolChoice.name });
+    rawToolChoice.name = sentName;
   }
+  recordToolAliases(request, ctx.toolAliases);
   const parallelToolCallsDisabled =
     request.generation_controls.parallel_tool_calls === false;
   const supportsToolChoice = options.dialectPolicy?.supportsToolChoice ?? true;

package/src/protocol/response/messages.ts

@@ -12,12 +12,33 @@ import { usageFromProvider } from '../../providers/provider-usage';
 import { mapClaudeStreamError } from '../messages-errors';
 import {
   finiteNumber,
+  restoreAliasedToolName,
   stringValue,
+  toolAliasesFor,
   unprefixClaudeToolName,
   type ClaudeWireObject,
+  type ToolNameAlias,
   isRecord,
 } from '../codecs';
 
+/**
+ * Restore a tool name from the wire to the caller's original, exactly.
+ *
+ * A name the builder renamed (recorded in `aliases`) is restored verbatim; any
+ * other name falls back to the OAuth underscore-unprefixing rule. This is the
+ * single restoration point for the Claude wire, so the two rules can never
+ * disagree between the stream and non-stream decoders.
+ */
+function restoreClaudeToolName(
+  sent: string,
+  isOAuth: boolean,
+  aliases: ReadonlyArray<ToolNameAlias>,
+): string {
+  const restored = restoreAliasedToolName(sent, aliases);
+  if (restored !== sent) return restored;
+  return unprefixClaudeToolName(sent, isOAuth);
+}
+
 export function mapClaudeStopReason(raw: string): CanonicalStopReason {
   switch (raw) {
     case "end_turn":
@@ -38,7 +59,7 @@ export function mapClaudeStopReason(raw: string): CanonicalStopReason {
   }
 }
 
-export function parseClaudeContent(value: unknown, isOAuth = false): ContentPart {
+export function parseClaudeContent(value: unknown, isOAuth = false, aliases: ReadonlyArray<ToolNameAlias> = []): ContentPart {
   if (stringValue(value)) return { kind: "text", text: value };
   if (!isRecord(value))
     return { kind: "extension", name: "messages:unknown", payload: value };
@@ -59,7 +80,7 @@ export function parseClaudeContent(value: unknown, isOAuth = false): ContentPart
     return {
       kind: "toolCall",
       call_id: value.id,
-      name: unprefixClaudeToolName(value.name, isOAuth),
+      name: restoreClaudeToolName(value.name, isOAuth, aliases),
       arguments: value.input ?? {},
       ...(finiteNumber(value.index) ? { index: value.index } : {}),
     };
@@ -77,7 +98,7 @@ export function parseClaudeContent(value: unknown, isOAuth = false): ContentPart
     const content = stringValue(value.content)
       ? value.content
       : Array.isArray(value.content)
-        ? value.content.map((content) => parseClaudeContent(content, isOAuth))
+        ? value.content.map((content) => parseClaudeContent(content, isOAuth, aliases))
         : value.content == null
           ? ""
           : [{ kind: "text" as const, text: String(value.content) }];
@@ -239,8 +260,9 @@ export function claudeResponseToEvents(
       model,
     },
   ];
+  const aliases = toolAliasesFor(request);
   const blocks = Array.isArray(json.content)
-    ? json.content.map((content) => parseClaudeContent(content, isOAuth))
+    ? json.content.map((content) => parseClaudeContent(content, isOAuth, aliases))
     : [];
   let sequence = 2;
   for (const block of blocks) {
@@ -292,6 +314,8 @@ interface ClaudeStreamState {
   rawUsage: Record<string, unknown> | undefined;
   sawMessageStop: boolean;
   isOAuth: boolean;
+  /** Tool renames recorded for this request, for exact restore. */
+  aliases: ReadonlyArray<ToolNameAlias>;
 }
 
 function streamEventToCanonical(
@@ -321,7 +345,7 @@ function streamEventToCanonical(
       state.calls.set(index, {
         call_id: block.id,
         ...(stringValue(block.name)
-          ? { name: unprefixClaudeToolName(block.name, state.isOAuth) }
+          ? { name: restoreClaudeToolName(block.name, state.isOAuth, state.aliases) }
           : {}),
       });
       // Anthropic sends `input: {}` as a *placeholder* on content_block_start,
@@ -332,13 +356,14 @@ function streamEventToCanonical(
       // send complete arguments here still gets them through.
       if (
         isRecord(block.input) &&
-        Object.keys(block.input).length > 0
+        Object.keys(block.input).length > 0 &&
+        stringValue(block.name)
       ) {
         events.push({
           type: "tool_call_delta",
           sequence_number: next++,
           call_id: block.id,
-          ...(stringValue(block.name) ? { name: unprefixClaudeToolName(block.name, state.isOAuth) } : {}),
+          name: restoreClaudeToolName(block.name, state.isOAuth, state.aliases),
           arguments_delta: JSON.stringify(block.input),
         });
       }
@@ -446,6 +471,7 @@ export async function* parseClaudeSseStream(
   body: ReadableStream<Uint8Array>,
   signal?: AbortSignal,
   isOAuth = false,
+  aliases: ReadonlyArray<ToolNameAlias> = [],
 ): AsyncIterable<CanonicalEvent> {
   const state: ClaudeStreamState = {
     calls: new Map(),
@@ -455,6 +481,7 @@ export async function* parseClaudeSseStream(
     rawUsage: undefined,
     sawMessageStop: false,
     isOAuth,
+    aliases,
   };
   let sequence = 1;
   for await (const sse of decodeSseEvents(body, { signal })) {

package/src/protocol/translation/quirks.ts

@@ -158,6 +158,21 @@ const PARAM_QUIRKS: readonly ParamQuirk[] = [
     // confirms that the selected-model request must not carry temperature.
     stripControls: ["temperature"],
   },
+  {
+    provider: "nvidia",
+    // NVIDIA NIM rejects a set of cross-wire fields with 400 even though the
+    // OpenAI-compatible chat wire permits them. Stripping them here keeps the
+    // dispatch on the same wire shape the upstream accepts.
+    stripControls: [
+      "extension:client_metadata",
+      "extension:prompt_cache_key",
+      "service_tier",
+      "extension:anthropic_beta",
+      "extension:thinking_budget",
+      "extension:metadata_user_id",
+      "extension:custom_field",
+    ],
+  },
   {
     provider: "anthropic",
     matchModel: rejectsSamplingParams,

package/src/protocol/upstream/send-claude-messages.ts

@@ -9,7 +9,7 @@ import { GatewayError } from '../gateway-error';
 import { applyRouteUserAgent, type ProviderDispatchContext } from "../../providers/provider-contracts";
 import { abortGatewayError, createUpstreamDeadlineLifecycle } from '../../providers/operations/upstream-deadline';
 import { mapClaudeHttpError } from '../messages-errors';
-import { isRecord } from '../codecs';
+import { isRecord, toolAliasesFor } from '../codecs';
 import { upstreamMessageAsIs, MAX_UPSTREAM_ERROR_BYTES } from '../../transport/failure-policy';
 import { parseClaudeSseStream, claudeResponseToEvents } from '../response/messages';
 
@@ -60,7 +60,7 @@ export async function* sendClaudeMessagesRequest(
         {},
         "upstream",
       );
-    yield* parseClaudeSseStream(response.body, context.abort_signal, isOAuth);
+    yield* parseClaudeSseStream(response.body, context.abort_signal, isOAuth, toolAliasesFor(request));
     return;
   }
   const body = await response.text().catch(() => "");

package/src/providers/adapters/compatible-adapter.ts

@@ -310,6 +310,11 @@ export class OpenAICompatibleAdapter extends BaseProviderAdapter {
       // plus `message_delta.usage` — so nothing is lost by omitting it.
       const existing = payload["stream_options"] as Record<string, unknown> | undefined;
       payload["stream_options"] = { ...(existing ?? {}), include_usage: true };
+    } else if (!effectiveRequest.stream && payload["stream_options"] !== undefined) {
+      // A non-streaming request must not carry `stream_options`: several
+      // OpenAI-compatible upstreams (NVIDIA NIM, DeepSeek) reject the body
+      // with 400 "Stream options can only be defined when stream=True".
+      delete payload["stream_options"];
     }
     // Apply structured_output configuration
     if (this.config.structured_output?.enabled) {

package/src/providers/authentication/oauth-client.ts

@@ -12,18 +12,20 @@ import {
   record,
 } from "./oauth-flow-store";
 import type {
+  OAuthAccountIdentity,
   OAuthAuthorizeRequest,
   OAuthCodeExchangeContext,
   OAuthExchangeResult,
   OAuthLoginClient,
 } from "./oauth-flow-store";
+import { oauthAccountIdentity } from "./oauth-flow-store";
 import type { OAuthTokenRefreshResult, OAuthTokenRefresher } from "./oauth-refresh-service";
 
 /** Minimal fetch surface accepted by the generic OAuth client. */
 export type FetchLike = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
 
 /** Normalized token shape returned by provider token endpoints. */
-export interface NormalizedTokenResponse {
+export interface NormalizedTokenResponse extends OAuthAccountIdentity {
   readonly access: string;
   readonly refresh: string;
   readonly expiresAt: Date;
@@ -83,12 +85,32 @@ export abstract class OAuthClient implements OAuthLoginClient, OAuthTokenRefresh
    */
   readonly browserRedirectUri?: string;
 
+  /**
+   * Custom state generator; `undefined` keeps the shared base64url state.
+   * A provider whose authorization server validates the format (e.g. DeepAI
+   * requires 32 hex chars) overrides this.
+   */
+  generateState(): string | undefined {
+    return undefined;
+  }
+
   protected readonly fetchFn: FetchLike;
 
   constructor(fetchFn: FetchLike = globalThis.fetch) {
     this.fetchFn = fetchFn;
   }
 
+  /**
+   * Resolves the transport a flow should use. When the console injects a
+   * `fetchFn` in the flow context (device-code OAuth routed through a network
+   * pool, see `device_flow_proxy`), that override wins; otherwise the
+   * client's own fetch is used. Every start/poll/exchange request that talks
+   * to the provider MUST route through this so the override is honored.
+   */
+  protected fetchFor(context?: { readonly fetchFn?: FetchLike | undefined }): FetchLike {
+    return context?.fetchFn ?? this.fetchFn;
+  }
+
   // ---------------------------------------------------------------------------
   // Public OAuthLoginClient surface
   // ---------------------------------------------------------------------------
@@ -135,8 +157,9 @@ export abstract class OAuthClient implements OAuthLoginClient, OAuthTokenRefresh
   }
 
   /** Extracts an account label from a token exchange/refresh response. */
-  protected extractAccountLabel(_data: unknown): string | undefined {
-    return undefined;
+  protected extractAccountLabel(data: unknown): string | undefined {
+    const identity = oauthAccountIdentity(data);
+    return identity.accountEmail ?? identity.accountName;
   }
 
   /** Calculates an expiry Date from an `expires_in` value. */
@@ -172,7 +195,14 @@ export abstract class OAuthClient implements OAuthLoginClient, OAuthTokenRefresh
     const refresh = nonEmptyString(body.refresh_token) ?? fallbackRefresh ?? "";
     const expiresAt = this.calculateExpiry(body.expires_in);
     const accountLabel = this.extractAccountLabel(data);
-    return { access, refresh, expiresAt, ...(accountLabel ? { accountLabel } : {}) };
+    const identity = oauthAccountIdentity(data);
+    return {
+      access,
+      refresh,
+      expiresAt,
+      ...identity,
+      ...(accountLabel ? { accountLabel } : {}),
+    };
   }
 
   /** Builds a PKCE authorization URL using the shared helper. */
@@ -231,22 +261,26 @@ export abstract class OAuthClient implements OAuthLoginClient, OAuthTokenRefresh
   // ---------------------------------------------------------------------------
 
   protected toExchangeResult(normalized: NormalizedTokenResponse): OAuthExchangeResult {
-    const { access, refresh, expiresAt, accountLabel, auth_state } = normalized;
+    const { access, refresh, expiresAt, accountLabel, accountEmail, accountName, auth_state } = normalized;
     return {
       access,
       refresh,
       expiresAt,
+      ...(accountEmail === undefined ? {} : { accountEmail }),
+      ...(accountName === undefined ? {} : { accountName }),
       ...(accountLabel ? { accountLabel } : {}),
       ...(auth_state === undefined ? {} : { auth_state }),
     };
   }
 
   protected toRefreshResult(normalized: NormalizedTokenResponse): OAuthTokenRefreshResult {
-    const { access, refresh, expiresAt, accountLabel, auth_state } = normalized;
+    const { access, refresh, expiresAt, accountLabel, accountEmail, accountName, auth_state } = normalized;
     return {
       access,
       ...(refresh ? { refresh } : {}),
       expiresAt,
+      ...(accountEmail === undefined ? {} : { accountEmail }),
+      ...(accountName === undefined ? {} : { accountName }),
       ...(accountLabel ? { accountLabel } : {}),
       ...(auth_state === undefined ? {} : { auth_state }),
     };

package/src/providers/authentication/oauth-device-flow.ts

@@ -37,9 +37,12 @@ export abstract class OAuthDeviceFlow extends OAuthClient {
   }
 
   /** Standard device-authorization start. Override the body builder for custom providers. */
-  protected async startGenericDeviceAuth(config: DeviceFlowConfig): Promise<OAuthDeviceStartResult> {
+  protected async startGenericDeviceAuth(
+    config: DeviceFlowConfig,
+    context?: OAuthDeviceFlowContext,
+  ): Promise<OAuthDeviceStartResult> {
     const body = this.buildDeviceStartBody(config);
-    const response = await this.fetchFn(config.deviceAuthUrl, {
+    const response = await this.fetchFor(context)(config.deviceAuthUrl, {
       method: "POST",
       ...(config.formHeaders === undefined ? {} : { headers: config.formHeaders }),
       body,
@@ -124,8 +127,9 @@ export abstract class OAuthDeviceFlow extends OAuthClient {
   protected async pollGenericDeviceAuth(
     deviceAuthId: string,
     config: DeviceFlowConfig,
+    context?: OAuthDeviceFlowContext,
   ): Promise<OAuthDevicePollResult> {
-    const response = await this.fetchFn(config.tokenUrl, {
+    const response = await this.fetchFor(context)(config.tokenUrl, {
       method: "POST",
       ...(config.formHeaders === undefined ? {} : { headers: config.formHeaders }),
       body: new URLSearchParams({