dedalus-cli 0.0.0-stage → 0.8.0

package/dist/cjs/sdk/client.js

@@ -0,0 +1,962 @@
+"use strict";
+// File generated from our OpenAPI spec by Scalar. See README.md for details.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Dedalus = void 0;
+const api_promise_1 = require("./api-promise");
+const pagination_1 = require("./core/pagination");
+const Errors = __importStar(require("./error"));
+const uuid7_1 = require("./internal/utils/uuid7");
+const values_1 = require("./internal/utils/values");
+const sleep_1 = require("./internal/utils/sleep");
+const errors_1 = require("./internal/errors");
+const body_1 = require("./internal/utils/body");
+const detect_platform_1 = require("./internal/detect-platform");
+const Shims = __importStar(require("./internal/shims"));
+const Opts = __importStar(require("./internal/request-options"));
+const env_1 = require("./internal/utils/env");
+const log_1 = require("./internal/utils/log");
+const headers_1 = require("./internal/headers");
+const query_1 = require("./internal/utils/query");
+const uploads_1 = require("./core/uploads");
+const version_1 = require("./version");
+const machines_1 = require("./resources/machines/machines");
+const organization_1 = require("./resources/organization/organization");
+const images_1 = require("./resources/images/images");
+/**
+ * API Client for interfacing with the Dedalus API.
+ */
+class Dedalus {
+    apiKey;
+    xAPIKey;
+    browserToken;
+    dedalusOrgID;
+    asBaseURL;
+    baseURL;
+    maxRetries;
+    timeout;
+    logger;
+    logLevel;
+    fetchOptions;
+    /**
+     * The `fetch` implementation every request is sent through: the `fetch` client option, or the
+     * platform default. A replacement must honor the same contract as that option.
+     */
+    fetch;
+    #encoder;
+    idempotencyHeader;
+    _baseURLOverridden;
+    _defaultBaseURL;
+    _options;
+    /**
+     * API Client for interfacing with the Dedalus API.
+     *
+     * @param {string | AuthTokenProvider | null | undefined} [opts.apiKey=process.env["DEDALUS_API_KEY"] ?? null]
+     * @param {string | AuthTokenProvider | null | undefined} [opts.xAPIKey=process.env["DEDALUS_X_API_KEY"] ?? null]
+     * @param {string | AuthTokenProvider | null | undefined} [opts.browserToken=process.env["DEDALUS_BROWSER_TOKEN"] ?? null]
+     * @param {string | null | undefined} [opts.dedalusOrgID=process.env["DEDALUS_ORG_ID"] ?? null]
+     * @param {string | null | undefined} [opts.asBaseURL=process.env["DEDALUS_AS_URL"] ?? "https://as.dedaluslabs.ai"]
+     * @param {string} [opts.baseURL=process.env["DEDALUS_BASE_URL"] ?? https://dcs.dedaluslabs.ai] - Override the default base URL for the API.
+     * @param {number} [opts.timeout=1 minute] - The maximum amount of time (in milliseconds) the client will wait for a response before timing out.
+     * @param {MergedRequestInit} [opts.fetchOptions] - Additional `RequestInit` options to be passed to `fetch` calls.
+     * @param {Fetch} [opts.fetch] - Specify a custom `fetch` function implementation.
+     * @param {number} [opts.maxRetries=2] - The maximum number of times the client will retry a request.
+     * @param {HeadersLike} opts.defaultHeaders - Default headers to include with every request to the API.
+     * @param {Record<string, string | undefined>} opts.defaultQuery - Default query parameters to include with every request to the API.
+     */
+    constructor({ baseURL = (0, env_1.readEnv)('DEDALUS_BASE_URL'), apiKey = (0, env_1.readEnv)('DEDALUS_API_KEY') ?? null, xAPIKey = (0, env_1.readEnv)('DEDALUS_X_API_KEY') ?? null, browserToken = (0, env_1.readEnv)('DEDALUS_BROWSER_TOKEN') ?? null, dedalusOrgID = (0, env_1.readEnv)('DEDALUS_ORG_ID') ?? null, asBaseURL = (0, env_1.readEnv)('DEDALUS_AS_URL') ?? 'https://as.dedaluslabs.ai', ...opts } = {}) {
+        const options = {
+            apiKey,
+            xAPIKey,
+            browserToken,
+            dedalusOrgID,
+            asBaseURL,
+            ...opts,
+            baseURL: baseURL || 'https://dcs.dedaluslabs.ai',
+        };
+        const baseURLOverridden = baseURL !== null && baseURL !== undefined && baseURL !== '';
+        const defaultBaseURL = 'https://dcs.dedaluslabs.ai';
+        this.baseURL = options.baseURL || defaultBaseURL;
+        this.timeout = options.timeout ?? Dedalus.DEFAULT_TIMEOUT /* 1 minute */;
+        this.logger = options.logger ?? console;
+        const defaultLogLevel = 'warn';
+        // Set default logLevel early so that we can log a warning in parseLogLevel.
+        this.logLevel = defaultLogLevel;
+        this.logLevel =
+            (0, log_1.parseLogLevel)(options.logLevel, 'ClientOptions.logLevel', this) ??
+                (0, log_1.parseLogLevel)((0, env_1.readEnv)('DEDALUS_LOG'), 'process.env["DEDALUS_LOG"]', this) ??
+                defaultLogLevel;
+        this.fetchOptions = options.fetchOptions;
+        this.maxRetries = options.maxRetries ?? 2;
+        this.fetch = options.fetch ?? Shims.getDefaultFetch();
+        this.#encoder = Opts.FallbackEncoder;
+        const customHeadersEnv = (0, env_1.readEnv)('DEDALUS_CUSTOM_HEADERS');
+        if (customHeadersEnv) {
+            const parsed = {};
+            for (const line of customHeadersEnv.split('\n')) {
+                const colon = line.indexOf(':');
+                if (colon >= 0) {
+                    parsed[line.substring(0, colon).trim()] = line.substring(colon + 1).trim();
+                }
+            }
+            options.defaultHeaders = { ...parsed, ...options.defaultHeaders };
+        }
+        this._options = { ...options, baseURL: baseURLOverridden ? this.baseURL : undefined };
+        this._baseURLOverridden = baseURLOverridden;
+        this._defaultBaseURL = defaultBaseURL;
+        this.idempotencyHeader = 'Idempotency-Key';
+        this.apiKey = apiKey;
+        this.xAPIKey = xAPIKey;
+        this.browserToken = browserToken;
+        this.dedalusOrgID = dedalusOrgID;
+        this.asBaseURL = asBaseURL;
+    }
+    withOptions(options) {
+        const client = new this.constructor({
+            ...this._options,
+            ...(this.#baseURLOverridden() ? { baseURL: this.baseURL } : {}),
+            maxRetries: this.maxRetries,
+            timeout: this.timeout,
+            logger: this.logger,
+            logLevel: this.logLevel,
+            fetch: this.fetch,
+            fetchOptions: this.fetchOptions,
+            apiKey: this.apiKey,
+            xAPIKey: this.xAPIKey,
+            browserToken: this.browserToken,
+            dedalusOrgID: this.dedalusOrgID,
+            asBaseURL: this.asBaseURL,
+            ...options,
+        });
+        return client;
+    }
+    #baseURLOverridden() {
+        // A named environment selects a default URL; only explicit overrides should bypass per-request defaults.
+        return this._baseURLOverridden || this.baseURL !== this._defaultBaseURL;
+    }
+    /**
+     * The client as `JSON.stringify` sees it: every credential masked, and the resource accessors,
+     * which point back at the client, left out.
+     */
+    toJSON() {
+        const view = {};
+        for (const [key, value] of Object.entries(this)) {
+            if (typeof value === 'object' && value !== null && value._client === this)
+                continue;
+            view[key] = redactClientField(key, value);
+        }
+        return view;
+    }
+    /** What `console.log` and `util.inspect` print for the client: the masked view `toJSON` builds. */
+    [Symbol.for('nodejs.util.inspect.custom')]() {
+        return this.toJSON();
+    }
+    defaultQuery() {
+        return this._options.defaultQuery;
+    }
+    stringifyQuery(query) {
+        return (0, query_1.stringifyQuery)(query);
+    }
+    getUserAgent() {
+        return `Dedalus/JS ${version_1.VERSION}`;
+    }
+    defaultIdempotencyKey() {
+        return (0, uuid7_1.uuid7)().replace(/-/g, '');
+    }
+    makeStatusError(status, error, message, headers) {
+        return Errors.APIError.generate(status, error, message, headers);
+    }
+    buildURL(path, query, defaultBaseURL) {
+        const baseURL = (!this.#baseURLOverridden() && defaultBaseURL) || this.baseURL;
+        // Guarantee exactly one "/" between baseURL and path so that bases without a trailing slash
+        // and paths without a leading slash do not fuse into a malformed URL (e.g. ".../v1" + "widgets").
+        const url = (0, values_1.isAbsoluteURL)(path)
+            ? new URL(path)
+            : new URL((baseURL.endsWith('/') ? baseURL : baseURL + '/') + (path.startsWith('/') ? path.slice(1) : path));
+        const defaultQuery = this.defaultQuery();
+        const pathQuery = Object.fromEntries(url.searchParams);
+        if (!(0, values_1.isEmptyObj)(defaultQuery) || !(0, values_1.isEmptyObj)(pathQuery)) {
+            query = { ...pathQuery, ...defaultQuery, ...query };
+        }
+        if (typeof query === 'object' && query && !Array.isArray(query)) {
+            url.search = this.stringifyQuery(query);
+        }
+        return url.toString();
+    }
+    /**
+     * Used as a callback for mutating the given `FinalRequestOptions` object.
+     */
+    async prepareOptions(options) { }
+    /**
+     * Used as a callback for mutating the given `RequestInit` object.
+     *
+     * This is useful for cases where you want to add certain headers based off of
+     * the request properties, e.g. `method` or `url`.
+     */
+    async prepareRequest(request, { url, options }) { }
+    get(path, opts) {
+        return this.methodRequest('get', path, opts);
+    }
+    post(path, opts) {
+        return this.methodRequest('post', path, opts);
+    }
+    patch(path, opts) {
+        return this.methodRequest('patch', path, opts);
+    }
+    put(path, opts) {
+        return this.methodRequest('put', path, opts);
+    }
+    delete(path, opts) {
+        return this.methodRequest('delete', path, opts);
+    }
+    methodRequest(method, path, opts) {
+        return this.request(Promise.resolve(opts).then((opts) => {
+            return { method, path, ...opts };
+        }));
+    }
+    request(options, remainingRetries = null) {
+        return new api_promise_1.APIPromise(this, this.makeRequest(options, remainingRetries, undefined));
+    }
+    async makeRequest(optionsInput, retriesRemaining, retryOfRequestLogID) {
+        const options = await optionsInput;
+        const maxRetries = options.maxRetries ?? this.maxRetries;
+        if (retriesRemaining == null) {
+            retriesRemaining = maxRetries;
+        }
+        await this.prepareOptions(options);
+        const { req, url, timeout } = await this.buildRequest(options, {
+            retryCount: maxRetries - retriesRemaining,
+        });
+        await this.prepareRequest(req, { url, options });
+        /** Not an API request ID, just for correlating local log entries. */
+        const requestLogID = 'log_' + ((Math.random() * (1 << 24)) | 0).toString(16).padStart(6, '0');
+        const retryLogStr = retryOfRequestLogID === undefined ? '' : `, retryOf: ${retryOfRequestLogID}`;
+        const startTime = Date.now();
+        (0, log_1.loggerFor)(this).debug(`[${requestLogID}] sending request`, (0, log_1.formatRequestDetails)({
+            retryOfRequestLogID,
+            method: options.method,
+            url,
+            options,
+            headers: req.headers,
+        }));
+        if (options.signal?.aborted) {
+            throw new Errors.APIUserAbortError();
+        }
+        const controller = new AbortController();
+        // The deadline stays armed until the body is read, not just until headers arrive, so a server
+        // that answers quickly and then trickles its body is still cut off at `timeout`.
+        const { release: releaseDeadline, unref: unrefDeadline } = this.#armDeadline(req.signal, timeout, controller);
+        // A subclass's own `fetchWithTimeout` sends the request; the deadline above still covers the body.
+        const viaOverride = this.fetchWithTimeout !== Dedalus.prototype.fetchWithTimeout;
+        const response = await (viaOverride
+            ? Promise.resolve().then(() => this.fetchWithTimeout(url, req, timeout, controller))
+            : this.#fetchFollowingRedirects(url, req, controller)).catch(errors_1.castToError);
+        const headersTime = Date.now();
+        if (response instanceof globalThis.Error) {
+            releaseDeadline();
+            // A redirect the SDK refused to follow fails the same way on every attempt, so it is not retried.
+            if (isRefusedRedirect(response))
+                throw response;
+            const retryMessage = `retrying, ${retriesRemaining} attempts remaining`;
+            if (options.signal?.aborted) {
+                throw new Errors.APIUserAbortError();
+            }
+            // detect native connection timeout errors
+            // deno throws "TypeError: error sending request for url (https://example/): client error (Connect): tcp connect error: Operation timed out (os error 60): Operation timed out (os error 60)"
+            // undici throws "TypeError: fetch failed" with cause "ConnectTimeoutError: Connect Timeout Error (attempted address: example:443, timeout: 1ms)"
+            // others do not provide enough information to distinguish timeouts from other connection errors
+            const isTimeout = (0, errors_1.isAbortError)(response) ||
+                /timed? ?out/i.test(String(response) + ('cause' in response ? String(response.cause) : ''));
+            if (retriesRemaining) {
+                (0, log_1.loggerFor)(this).info(`[${requestLogID}] connection ${isTimeout ? 'timed out' : 'failed'} - ${retryMessage}`);
+                (0, log_1.loggerFor)(this).debug(`[${requestLogID}] connection ${isTimeout ? 'timed out' : 'failed'} (${retryMessage})`, (0, log_1.formatRequestDetails)({
+                    retryOfRequestLogID,
+                    url,
+                    durationMs: headersTime - startTime,
+                    message: response.message,
+                }));
+                return this.retryRequest(options, retriesRemaining, retryOfRequestLogID ?? requestLogID);
+            }
+            (0, log_1.loggerFor)(this).info(`[${requestLogID}] connection ${isTimeout ? 'timed out' : 'failed'} - error; no more retries left`);
+            (0, log_1.loggerFor)(this).debug(`[${requestLogID}] connection ${isTimeout ? 'timed out' : 'failed'} (error; no more retries left)`, (0, log_1.formatRequestDetails)({
+                retryOfRequestLogID,
+                url,
+                durationMs: headersTime - startTime,
+                message: response.message,
+            }));
+            if (isTimeout) {
+                throw new Errors.APIConnectionTimeoutError();
+            }
+            throw new Errors.APIConnectionError({ cause: response });
+        }
+        const responseInfo = `[${requestLogID}${retryLogStr}] ${req.method} ${(0, log_1.redactUrl)(url)} ${response.ok ? 'succeeded' : 'failed'} with status ${response.status} in ${headersTime - startTime}ms`;
+        if (!response.ok) {
+            const shouldRetry = await this.shouldRetry(response);
+            if (retriesRemaining && shouldRetry) {
+                const retryMessage = `retrying, ${retriesRemaining} attempts remaining`;
+                // We don't need the body of this response.
+                releaseDeadline();
+                await Shims.CancelReadableStream(response.body);
+                (0, log_1.loggerFor)(this).info(`${responseInfo} - ${retryMessage}`);
+                (0, log_1.loggerFor)(this).debug(`[${requestLogID}] response error (${retryMessage})`, (0, log_1.formatRequestDetails)({
+                    retryOfRequestLogID,
+                    url: response.url,
+                    status: response.status,
+                    headers: response.headers,
+                    durationMs: headersTime - startTime,
+                }));
+                return this.retryRequest(options, retriesRemaining, retryOfRequestLogID ?? requestLogID, response.headers);
+            }
+            const retryMessage = shouldRetry ? `error; no more retries left` : `error; not retryable`;
+            (0, log_1.loggerFor)(this).info(`${responseInfo} - ${retryMessage}`);
+            // Only the first 64 KiB of an error body is read: enough for any message, and a hostile or
+            // broken server cannot make the client buffer more. The read still runs under the deadline.
+            const errText = await (0, body_1.readBodyText)(response, body_1.MAX_ERROR_BODY_BYTES, 'truncate').catch((err) => (0, errors_1.castToError)(err).message);
+            releaseDeadline();
+            const errJSON = (0, values_1.safeJSON)(errText);
+            const errMessage = errJSON ? undefined : errText;
+            (0, log_1.loggerFor)(this).debug(`[${requestLogID}] response error (${retryMessage})`, (0, log_1.formatRequestDetails)({
+                retryOfRequestLogID,
+                url: response.url,
+                status: response.status,
+                headers: response.headers,
+                message: errMessage,
+                durationMs: Date.now() - startTime,
+            }));
+            const err = this.makeStatusError(response.status, errJSON, errMessage, response.headers);
+            throw err;
+        }
+        (0, log_1.loggerFor)(this).info(responseInfo);
+        (0, log_1.loggerFor)(this).debug(`[${requestLogID}] response start`, (0, log_1.formatRequestDetails)({
+            retryOfRequestLogID,
+            url: response.url,
+            status: response.status,
+            headers: response.headers,
+            durationMs: headersTime - startTime,
+        }));
+        // A streamed or binary body is the caller's to read at its own pace, so the deadline ends with
+        // the headers there; a buffered body keeps it until `defaultParseResponse` has read it.
+        if (options.stream || options.__binaryResponse)
+            releaseDeadline();
+        else {
+            // Unreferenced so a response nobody parses (a call never awaited) cannot hold the process
+            // open until the deadline; a body being read keeps it alive through its own socket.
+            unrefDeadline();
+            (0, body_1.holdDeadline)(controller, releaseDeadline);
+        }
+        return { response, options, controller, requestLogID, retryOfRequestLogID, startTime };
+    }
+    // Public escape hatch for list endpoints the spec does not describe: the page type parameter
+    // defaults so `getAPIList<Item>(path, MyPage)` needs only the item type, and the page argument
+    // is a bare constructor so a hand-rolled page class need not restate the runtime page
+    // constructor's parameter types.
+    getAPIList(path, Page, options, method = 'get') {
+        // List endpoints are usually GET, but a body-located cursor scheme rides a POST body, so the
+        // caller passes the operation's actual verb. The method is preserved across auto-advanced
+        // pages because `nextPageRequestOptions` spreads the stored request options (incl. `method`).
+        const requestOptions = Promise.resolve(options).then((opts) => ({ ...opts, method, path }));
+        return this.requestAPIList(Page, requestOptions);
+    }
+    requestAPIList(Page, options) {
+        // `Item` is passed explicitly because the page constructor carries no slot to infer it from.
+        return new pagination_1.PagePromise(this, this.makeRequest(options, null, undefined), Page);
+    }
+    /**
+     * Sends one request with a deadline on its response headers, following redirects as the client
+     * does.
+     *
+     * Override it in a subclass to wrap every HTTP request this client sends to its API, retries included;
+     * call `super.fetchWithTimeout` to send, which keeps the client's redirect handling. When a redirect
+     * leaves the origin that drops the client's own credential headers, but a header an override adds
+     * goes on to the redirect target, so a secret belongs in a client option rather than added here.
+     * A client that does not override it skips this method and sends directly.
+     *
+     * The SDK's own deadline aborts `controller` and stays armed until a buffered body is read, so it
+     * cuts off an override that sends through `super` or passes `controller.signal` on; a larger `ms`
+     * passed to `super` cannot extend it, so set the `timeout` option instead.
+     */
+    async fetchWithTimeout(url, init, ms, controller) {
+        const deadline = this.#armDeadline(init?.signal, ms, controller);
+        try {
+            return await this.#fetchFollowingRedirects(url, init, controller);
+        }
+        finally {
+            deadline.release();
+        }
+    }
+    /**
+     * Starts the request deadline on `controller` and forwards the caller's abort signal to it.
+     *
+     * `release` disarms the deadline. `unref` stops it alone from keeping a Node process alive, for
+     * the stretch where it waits on a body nobody may ever read.
+     */
+    #armDeadline(signal, ms, controller) {
+        const abort = this._makeAbort(controller);
+        if (signal?.aborted)
+            abort();
+        else if (signal)
+            signal.addEventListener('abort', abort, { once: true });
+        const timeout = setTimeout(abort, ms);
+        return {
+            release: () => clearTimeout(timeout),
+            unref: () => timeout?.unref?.(),
+        };
+    }
+    /**
+     * Sends one request, following its redirects here rather than in `fetch`.
+     *
+     * Platform `fetch` strips only `Authorization` when a redirect leaves the origin, so it would hand
+     * a header API key, cookies and a 307 body to whatever host the API names. Following here, where
+     * the client knows which headers carry credentials, keeps them on the API's own origin.
+     */
+    async #fetchFollowingRedirects(url, init, controller) {
+        const { signal, method, ...options } = init || {};
+        const isReadableBody = isOneShotBody(options.body);
+        const request = typeof url === 'string' || url instanceof URL ? undefined : url;
+        const carriesUnguardedCredential = [...new Headers(options.headers ?? request?.headers).keys()].some((name) => CREDENTIAL_HEADERS.includes(name) && !BROWSER_GUARDED_HEADERS.includes(name));
+        const browserFollows = hidesRedirectTargets() && !carriesUnguardedCredential;
+        const callerRedirect = options.redirect === 'error' || options.redirect === 'manual' ? options.redirect : undefined;
+        const fetchOptions = {
+            signal: controller.signal,
+            ...(isReadableBody ? { duplex: 'half' } : {}),
+            method: 'GET',
+            ...options,
+            redirect: callerRedirect ?? (browserFollows ? 'follow' : 'manual'),
+        };
+        if (method) {
+            // Custom methods like 'patch' need to be uppercased
+            // See https://github.com/nodejs/undici/issues/2294
+            fetchOptions.method = method.toUpperCase();
+        }
+        // use undefined this binding; fetch errors if bound to something else in browsers and edge runtimes / workers
+        let response = await this.fetch.call(undefined, url, fetchOptions);
+        let current = request ? request.url : String(url);
+        let hop = {
+            ...fetchOptions,
+            headers: new Headers(fetchOptions.headers ?? request?.headers),
+        };
+        // Once a hop leaves the origin, credentials stay dropped for the rest of the chain, even if a
+        // later hop comes back: the foreign host chose where that hop goes.
+        let leftOrigin = false;
+        for (let redirects = 0;; redirects++) {
+            if (callerRedirect)
+                return response;
+            if (hop.redirect === 'manual' && response.redirected) {
+                throw refuseRedirect("The fetch implementation followed a redirect itself although the client asked it not to, so its response was not used. A custom fetch must honor redirect: 'manual'.");
+            }
+            if (response.type === 'opaqueredirect') {
+                // Browsers answer a manual redirect with an opaque response that hides its target, so there
+                // is nothing safe to follow; it is refused rather than mistaken for the API's answer.
+                throw refuseRedirect(carriesUnguardedCredential
+                    ? 'The server answered with a redirect, which this request does not follow: the platform hides the target from the SDK, and the request carries an API key header that could reach another host. Call the redirect target directly, or send the request from a server.'
+                    : 'The server answered with a redirect whose target this platform hides from the SDK, so it was not followed. Call the redirect target directly, or send the request from a server.');
+            }
+            const location = REDIRECT_STATUSES.includes(response.status)
+                ? response.headers.get('location')?.trim()
+                : undefined;
+            if (!location)
+                return response;
+            await Shims.CancelReadableStream(response.body);
+            if (redirects >= MAX_REDIRECTS)
+                throw refuseRedirect(`Maximum redirects exceeded (${MAX_REDIRECTS}).`);
+            const from = new URL(current);
+            let target;
+            try {
+                target = new URL(location, from);
+            }
+            catch {
+                throw refuseRedirect('The server redirected to a URL that cannot be parsed.');
+            }
+            if (target.protocol !== 'https:' && target.protocol !== 'http:') {
+                throw refuseRedirect(`Refusing to follow a redirect to a ${target.protocol} URL.`);
+            }
+            if (from.protocol === 'https:' && target.protocol === 'http:') {
+                throw refuseRedirect('Refusing to follow a redirect from https to http.');
+            }
+            const headers = new Headers(hop.headers);
+            let nextMethod = hop.method ?? 'GET';
+            let body = hop.body ?? request?.body ?? undefined;
+            // A 303 (but for HEAD), and a 301 or 302 answering a POST, re-ask with a bodiless GET, as
+            // browsers do. Every other redirect repeats the request, so its body has to be sent again.
+            if ((response.status === 303 && nextMethod !== 'HEAD') ||
+                ((response.status === 301 || response.status === 302) && nextMethod === 'POST')) {
+                nextMethod = 'GET';
+                body = undefined;
+                for (const name of [...headers.keys()])
+                    if (name.startsWith('content-'))
+                        headers.delete(name);
+            }
+            else if (body != null && isOneShotBody(body)) {
+                throw refuseRedirect(`Refusing to follow a ${response.status} redirect: the request body was a stream, which cannot be sent again.`);
+            }
+            if (target.origin !== from.origin)
+                leftOrigin = true;
+            if (leftOrigin) {
+                for (const name of CREDENTIAL_HEADERS)
+                    headers.delete(name);
+            }
+            else {
+                // A `Location` the server spelled does not repeat our query credentials, so a same-origin
+                // hop carries them over; appended rather than set so the target's own query keeps its bytes.
+                for (const name of CREDENTIAL_QUERY) {
+                    const value = from.searchParams.get(name);
+                    if (value === null || target.searchParams.has(name))
+                        continue;
+                    target.search =
+                        (target.search ? target.search + '&' : '?') +
+                            encodeURIComponent(name) +
+                            '=' +
+                            encodeURIComponent(value);
+                }
+            }
+            hop = { ...hop, method: nextMethod, headers };
+            if (body == null) {
+                delete hop.body;
+                delete hop.duplex;
+            }
+            else {
+                hop.body = body;
+            }
+            current = target.href;
+            response = await this.fetch.call(undefined, current, hop);
+        }
+    }
+    async shouldRetry(response) {
+        // Note this is not a standard header.
+        const shouldRetryHeader = response.headers.get('x-should-retry');
+        // If the server explicitly says whether or not to retry, obey.
+        if (shouldRetryHeader === 'true')
+            return true;
+        if (shouldRetryHeader === 'false')
+            return false;
+        // Retry on request timeouts.
+        if (response.status === 408)
+            return true;
+        // Retry on lock timeouts.
+        if (response.status === 409)
+            return true;
+        // Retry on rate limits.
+        if (response.status === 429)
+            return true;
+        // Retry internal errors.
+        if (response.status >= 500)
+            return true;
+        return false;
+    }
+    async retryRequest(options, retriesRemaining, requestLogID, responseHeaders) {
+        let timeoutMillis;
+        // Note the `retry-after-ms` header may not be standard, but is a good idea and we'd like proactive support for it.
+        const retryAfterMillisHeader = responseHeaders?.get('retry-after-ms');
+        if (retryAfterMillisHeader) {
+            const timeoutMs = parseFloat(retryAfterMillisHeader);
+            if (!Number.isNaN(timeoutMs)) {
+                timeoutMillis = timeoutMs;
+            }
+        }
+        // About the Retry-After header: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Retry-After
+        const retryAfterHeader = responseHeaders?.get('retry-after');
+        if (retryAfterHeader && !timeoutMillis) {
+            const timeoutSeconds = parseFloat(retryAfterHeader);
+            if (!Number.isNaN(timeoutSeconds)) {
+                timeoutMillis = timeoutSeconds * 1000;
+            }
+            else {
+                timeoutMillis = Date.parse(retryAfterHeader) - Date.now();
+            }
+        }
+        // If the API asks us to wait a certain amount of time, just do what it says,
+        // but cap server-provided delays at 60s so an oversized or malformed Retry-After
+        // (e.g. `retry-after-ms: 999999999`, a past HTTP-date, or a value that Date.parse
+        // failed on) cannot block retries for an unbounded amount of time. Otherwise fall
+        // back to the default exponential-backoff calculation.
+        const maxRetryAfterMillis = 60 * 1000;
+        if (timeoutMillis === undefined ||
+            !Number.isFinite(timeoutMillis) ||
+            timeoutMillis <= 0 ||
+            timeoutMillis > maxRetryAfterMillis) {
+            const maxRetries = options.maxRetries ?? this.maxRetries;
+            timeoutMillis = this.calculateDefaultRetryTimeoutMillis(retriesRemaining, maxRetries);
+        }
+        await (0, sleep_1.sleep)(timeoutMillis);
+        return this.makeRequest(options, retriesRemaining - 1, requestLogID);
+    }
+    calculateDefaultRetryTimeoutMillis(retriesRemaining, maxRetries) {
+        const initialRetryDelay = 0.5;
+        const maxRetryDelay = 8.0;
+        const numRetries = maxRetries - retriesRemaining;
+        // Apply exponential backoff, but not more than the max.
+        const sleepSeconds = Math.min(initialRetryDelay * Math.pow(2, numRetries), maxRetryDelay);
+        // Apply some jitter, take up to at most 25 percent of the retry time.
+        const jitter = 1 - Math.random() * 0.25;
+        return sleepSeconds * jitter * 1000;
+    }
+    async buildRequest(inputOptions, { retryCount = 0 } = {}) {
+        const options = { ...inputOptions };
+        const { method, path, query, defaultBaseURL } = options;
+        const url = this.buildURL(path, query, defaultBaseURL);
+        if ('timeout' in options)
+            (0, values_1.validatePositiveInteger)('timeout', options.timeout);
+        options.timeout = options.timeout ?? this.timeout;
+        const { bodyHeaders, body } = this.buildBody({ options });
+        // Headers read the caller's own options, not the copy defaulted above: `X-Scalar-Timeout`
+        // reports an explicit per-request timeout, and the idempotency key written back here has to
+        // land where the retry can see it.
+        const reqHeaders = await this.buildHeaders({
+            options: inputOptions,
+            method,
+            bodyHeaders,
+            retryCount,
+            url,
+        });
+        const req = {
+            method,
+            headers: reqHeaders,
+            ...(options.signal && { signal: options.signal }),
+            ...(globalThis.ReadableStream &&
+                body instanceof globalThis.ReadableStream && { duplex: 'half' }),
+            // `buildBody` already collapses no-body into `undefined`; here we only need to drop that
+            // sentinel. A truthiness spread would also strip an intentional empty-string body.
+            ...(body !== undefined && { body }),
+            ...(this.fetchOptions ?? {}),
+            ...(options.fetchOptions ?? {}),
+        };
+        return { req, url, timeout: options.timeout };
+    }
+    async buildHeaders({ options, method, bodyHeaders, retryCount, url, }) {
+        let idempotencyHeaders = {};
+        if (this.idempotencyHeader && method !== 'get') {
+            if (!options.idempotencyKey)
+                options.idempotencyKey = this.defaultIdempotencyKey();
+            idempotencyHeaders[this.idempotencyHeader] = options.idempotencyKey;
+        }
+        const headers = (0, headers_1.buildHeaders)([
+            idempotencyHeaders,
+            {
+                Accept: 'application/json',
+                'User-Agent': this.getUserAgent(),
+                'X-Scalar-Retry-Count': String(retryCount),
+                ...(options.timeout ? { 'X-Scalar-Timeout': String(Math.trunc(options.timeout / 1000)) } : {}),
+                ...(0, detect_platform_1.getPlatformHeaders)(),
+                ...{ 'X-SDK-Version': '1.0.0' },
+                'X-Dedalus-Org-Id': this.dedalusOrgID,
+            },
+            await this.authHeaders(options),
+            this._options.defaultHeaders,
+            bodyHeaders,
+            options.headers,
+        ]);
+        appendAuthCookies(headers.values, await this.authCookiesAsync());
+        this.validateAuth(url, headers.values, options);
+        // Last, so a subclass sees the headers as they leave here, after the SDK has checked the auth.
+        await this.validateHeaders(headers);
+        return headers.values;
+    }
+    /**
+     * Runs once for every HTTP request built from the client's headers, at the end of header building,
+     * with the headers it will be sent with: `values` holds them and `nulls` the names the call removed
+     * with a `null`.
+     * Throwing, or rejecting from an `async` override, which is awaited, rejects the request before it
+     * is sent. Does nothing unless a subclass overrides it.
+     * `fetchOptions.headers` and `prepareRequest` are applied afterwards, so the hook does not see them.
+     */
+    validateHeaders({ values, nulls }) { }
+    _makeAbort(controller) {
+        // note: we can't just inline this method inside `#armDeadline()` because then the closure
+        //       would capture all request options, and cause a memory leak.
+        return () => controller.abort();
+    }
+    buildBody({ options: { body, headers: rawHeaders } }) {
+        // Skip only `null`/`undefined` so an intentional empty-string (or 0/false) payload still
+        // reaches the encoder. A plain `!body` check would silently drop those falsy-but-valid bodies,
+        // and `null` must be excluded here too because the iterator check below uses `in`, which
+        // throws on null.
+        if (body == null) {
+            return { bodyHeaders: undefined, body: undefined };
+        }
+        // A `content-type` from either header bag says how the body is already encoded; the request's
+        // own wins over the client-wide default, as it does on the wire.
+        const headers = (0, headers_1.buildHeaders)([this._options.defaultHeaders, rawHeaders]);
+        if (
+        // Pass raw type verbatim
+        ArrayBuffer.isView(body) ||
+            body instanceof ArrayBuffer ||
+            body instanceof DataView ||
+            // A string is only already-encoded when something has said what it is encoded as.
+            // Generated call sites state the declared request media type, so a `text/plain` or
+            // ndjson payload reaches the wire byte-for-byte. A string with no `content-type` came
+            // from a body the document declared as JSON — `{ "type": "string" }` — and encoding it
+            // below is what puts the quotes the server parses for around it.
+            (typeof body === 'string' && headers.values.has('content-type')) ||
+            // `Blob` is superset of `File`
+            (globalThis.Blob && body instanceof globalThis.Blob) ||
+            // `FormData` -> `multipart/form-data`
+            body instanceof FormData ||
+            // `URLSearchParams` -> `application/x-www-form-urlencoded`
+            body instanceof URLSearchParams ||
+            // Send chunked stream (each chunk has own `length`)
+            (globalThis.ReadableStream && body instanceof globalThis.ReadableStream)) {
+            return { bodyHeaders: undefined, body: body };
+        }
+        else if (typeof body === 'object' &&
+            (Symbol.asyncIterator in body ||
+                (Symbol.iterator in body && 'next' in body && typeof body.next === 'function'))) {
+            return { bodyHeaders: undefined, body: Shims.ReadableStreamFrom(body) };
+        }
+        else if (typeof body === 'object' &&
+            headers.values.get('content-type') === 'application/x-www-form-urlencoded') {
+            return {
+                bodyHeaders: { 'content-type': 'application/x-www-form-urlencoded' },
+                body: this.stringifyQuery(body),
+            };
+        }
+        else {
+            return this.#encoder({ body, headers });
+        }
+    }
+    validateAuth(url, headers, options) {
+        if (headers.has('Authorization'))
+            return;
+        if (headerExplicitlyOmitted(options.headers, 'Authorization'))
+            return;
+        if (headers.has('x-api-key'))
+            return;
+        if (headerExplicitlyOmitted(options.headers, 'x-api-key'))
+            return;
+        throw new Errors.AuthenticationError(401, undefined, 'Could not resolve authentication method. Expected either apiKey, browserToken or xAPIKey to be set. Or for one of the "Authorization" or "x-api-key" headers to be explicitly omitted', headers);
+    }
+    authHeadersSync() {
+        const headers = {};
+        const apiKey = this.resolveAuthOptionSync('apiKey', this.apiKey);
+        if (apiKey)
+            headers['Authorization'] = `Bearer ${apiKey}`;
+        const xAPIKey = this.resolveAuthOptionSync('xAPIKey', this.xAPIKey);
+        if (xAPIKey)
+            headers['x-api-key'] = xAPIKey;
+        const browserToken = this.resolveAuthOptionSync('browserToken', this.browserToken);
+        if (browserToken)
+            headers['Authorization'] = `Bearer ${browserToken}`;
+        return headers;
+    }
+    webSocketAuthHeaders() {
+        const apiKey = this.resolveAuthOptionSync('apiKey', this.apiKey);
+        if (apiKey)
+            return { Authorization: `Bearer ${apiKey}` };
+        const xAPIKey = this.resolveAuthOptionSync('xAPIKey', this.xAPIKey);
+        if (xAPIKey)
+            return { 'x-api-key': xAPIKey };
+        return {};
+    }
+    async authHeaders(opts) {
+        return (0, headers_1.buildHeaders)([
+            await this.bearerAuth(opts),
+            await this.apiKeyAuth(opts),
+            await this.browserAuth(opts),
+        ]);
+    }
+    async bearerAuth(opts) {
+        const apiKey = await this.resolveAuthOption('apiKey', this.apiKey);
+        if (apiKey == null) {
+            return undefined;
+        }
+        return (0, headers_1.buildHeaders)([{ Authorization: `Bearer ${apiKey}` }]);
+    }
+    async apiKeyAuth(opts) {
+        const xAPIKey = await this.resolveAuthOption('xAPIKey', this.xAPIKey);
+        if (xAPIKey == null) {
+            return undefined;
+        }
+        return (0, headers_1.buildHeaders)([{ 'x-api-key': xAPIKey }]);
+    }
+    async browserAuth(opts) {
+        const browserToken = await this.resolveAuthOption('browserToken', this.browserToken);
+        if (browserToken == null) {
+            return undefined;
+        }
+        return (0, headers_1.buildHeaders)([{ Authorization: `Bearer ${browserToken}` }]);
+    }
+    async authQueryAsync() {
+        const query = {};
+        return query;
+    }
+    async authCookiesAsync() {
+        const cookies = {};
+        return cookies;
+    }
+    async resolveAuthOption(optionName, value) {
+        if (value == null)
+            return undefined;
+        const token = typeof value === 'function' ? await value() : value;
+        if (!token)
+            throw new Errors.DedalusError(`Expected '${optionName}' to resolve to a non-empty string.`);
+        return token;
+    }
+    resolveAuthOptionSync(optionName, value) {
+        if (value == null)
+            return undefined;
+        const token = typeof value === 'function' ? value() : value;
+        if (typeof token !== 'string' || !token)
+            throw new Errors.DedalusError(`Expected '${optionName}' to resolve to a non-empty string.`);
+        return token;
+    }
+    static Dedalus = this;
+    static DEFAULT_TIMEOUT = 60000; // 1 minute
+    static DedalusError = Errors.DedalusError;
+    static APIError = Errors.APIError;
+    static APIConnectionError = Errors.APIConnectionError;
+    static APIConnectionTimeoutError = Errors.APIConnectionTimeoutError;
+    static APIUserAbortError = Errors.APIUserAbortError;
+    static NotFoundError = Errors.NotFoundError;
+    static ConflictError = Errors.ConflictError;
+    static RateLimitError = Errors.RateLimitError;
+    static BadRequestError = Errors.BadRequestError;
+    static AuthenticationError = Errors.AuthenticationError;
+    static InternalServerError = Errors.InternalServerError;
+    static PermissionDeniedError = Errors.PermissionDeniedError;
+    static UnprocessableEntityError = Errors.UnprocessableEntityError;
+    static toFile = uploads_1.toFile;
+    machines = new machines_1.Machines(this);
+    organization = new organization_1.Organization(this);
+    images = new images_1.Images(this);
+}
+exports.Dedalus = Dedalus;
+Dedalus.Machines = machines_1.Machines;
+Dedalus.Organization = organization_1.Organization;
+Dedalus.Images = images_1.Images;
+const headerExplicitlyOmitted = (source, name) => {
+    if (!source || Array.isArray(source) || source instanceof Headers)
+        return false;
+    const target = name.toLowerCase();
+    return Object.entries(source).some(([key, value]) => key.toLowerCase() === target && value === null);
+};
+const appendAuthCookies = (headers, cookies) => {
+    for (const [name, value] of Object.entries(cookies)) {
+        if (cookieHeaderHas(headers.get('Cookie'), name))
+            continue;
+        const cookie = encodeURIComponent(name) + '=' + encodeURIComponent(value);
+        const existing = headers.get('Cookie');
+        headers.set('Cookie', existing ? existing + '; ' + cookie : cookie);
+    }
+};
+const cookieHeaderHas = (value, name) => {
+    if (!value)
+        return false;
+    const target = encodeURIComponent(name) + '=';
+    return value.split(';').some((cookie) => cookie.trim().startsWith(target));
+};
+/** Client fields holding a secret, masked whenever the client is printed or serialized. */
+const SECRET_CLIENT_FIELDS = ['apiKey', 'xAPIKey', 'browserToken'];
+/**
+ * One field of the client (or of its stored options) as a printed client shows it. Credentials are
+ * masked outright; header bags go through the log redaction, which knows every header this SDK
+ * authenticates with; a base URL loses any userinfo or query credential it carries.
+ */
+const redactClientField = (key, value) => {
+    if (value === null || value === undefined)
+        return value;
+    if (SECRET_CLIENT_FIELDS.includes(key))
+        return '***';
+    if (key === 'baseURL' && typeof value === 'string')
+        return (0, log_1.redactUrl)(value);
+    if (key === 'defaultHeaders') {
+        if (value instanceof Headers)
+            return (0, log_1.redactHeaders)(value);
+        if (typeof value !== 'object' || Array.isArray(value))
+            return '***';
+        const redactValue = (name, field) => {
+            if (typeof field === 'string')
+                return (0, log_1.redactHeaders)({ [name]: field })[name];
+            if (Array.isArray(field))
+                return field.map((entry) => redactValue(name, entry));
+            return field === null || field === undefined ? field : '***';
+        };
+        return Object.fromEntries(Object.entries(value).map(([name, field]) => [name, redactValue(name, field)]));
+    }
+    if (typeof value !== 'object')
+        return value;
+    if (key === 'fetchOptions') {
+        const { headers: _headers, ...rest } = value;
+        return _headers === undefined ? rest : { ...rest, headers: '***' };
+    }
+    if (key === '_options') {
+        return Object.fromEntries(Object.entries(value).map(([name, field]) => [name, redactClientField(name, field)]));
+    }
+    return value;
+};
+/** Statuses the client follows when they carry a `Location`; any other 3xx is the server's answer. */
+const REDIRECT_STATUSES = [301, 302, 303, 307, 308];
+/** The most redirects one request follows, the same cap the platform `fetch` uses. */
+const MAX_REDIRECTS = 20;
+/**
+ * Headers that carry a credential: the platform's own and every header this API's security schemes
+ * place. A redirect that leaves the origin drops each of them, wherever it was set.
+ */
+const CREDENTIAL_HEADERS = ['authorization', 'cookie', 'proxy-authorization', 'x-api-key'];
+/** Query parameters this API's security schemes place, carried only to a same-origin redirect target. */
+const CREDENTIAL_QUERY = [];
+/**
+ * Credential headers a browser keeps on the origin itself: it drops `Authorization` from a
+ * cross-origin redirect and never lets script set the other two.
+ */
+const BROWSER_GUARDED_HEADERS = ['authorization', 'cookie', 'proxy-authorization'];
+/**
+ * Whether this runtime's fetch answers a manual redirect opaquely, hiding its target: a browser
+ * page, or a dedicated, shared or service worker in one. A worker scope alone is not enough,
+ * since edge runtimes model theirs on it while returning the real 3xx; a browser user agent is.
+ */
+const hidesRedirectTargets = () => {
+    if ((0, detect_platform_1.isRunningInBrowser)())
+        return true;
+    if (typeof globalThis.WorkerGlobalScope === 'undefined')
+        return false;
+    const agent = globalThis.navigator?.userAgent;
+    return typeof agent === 'string' && agent.startsWith('Mozilla/');
+};
+/** Marks the error for a redirect the client refused to follow, which `makeRequest` does not retry. */
+const REFUSED_REDIRECT = Symbol('refusedRedirect');
+/** Marks `error` as a redirect refusal, which no retry layer repeats. */
+const markRefusedRedirect = (error) => {
+    error[REFUSED_REDIRECT] = true;
+    return error;
+};
+/** A connection error for a redirect the client will not follow. */
+const refuseRedirect = (message) => markRefusedRedirect(new Errors.APIConnectionError({ message }));
+/** Whether `error` is a redirect refusal from {@link refuseRedirect}. */
+const isRefusedRedirect = (error) => typeof error === 'object' &&
+    error !== null &&
+    error[REFUSED_REDIRECT] === true;
+/** Whether a request body can be read only once, so a redirect that repeats the request cannot resend it. */
+const isOneShotBody = (body) => !!((globalThis.ReadableStream && body instanceof globalThis.ReadableStream) ||
+    (typeof body === 'object' && body !== null && Symbol.asyncIterator in body));
+//# sourceMappingURL=client.js.map