e621 3.4.1 → 3.5.1

package/dist/lib/OAuthClient.d.ts

@@ -0,0 +1,152 @@
+import { type Options } from "./client.js";
+import type { OAuthIntrospection, OAuthScope, OAuthToken, OAuthTokenInfo, OAuthUserInfo, OpenIDConfiguration } from "./generated/types.js";
+/** @category OAuth */
+export interface OAuthClientOptions extends Pick<Options, "baseURL" | "ratelimit" | "requestTimeout" | "userAgent" | "userAgentInQuery"> {
+    /** The client id (uid) of your OAuth application. */
+    clientId: string;
+    /**
+     * The client secret of your OAuth application. Leave out for public clients (e.g. browser or
+     * desktop apps, where the secret can't be kept private) - PKCE is always used either way.
+     * @default none
+     */
+    clientSecret?: string;
+    /**
+     * Called whenever the stored token changes (exchanged, refreshed, or revoked - `null` in that case).
+     * Use this to persist the token, and pass it back in as {@link OAuthClientOptions.token} later.
+     * @default none
+     */
+    onToken?: (token: OAuthToken | null) => void | Promise<void>;
+    /**
+     * The redirect uri registered for your application. Used by default by
+     * {@link OAuthClient.createAuthorizationURL} and {@link OAuthClient.exchangeCode}.
+     * @default none
+     */
+    redirectURI?: string;
+    /**
+     * How many seconds before the access token expires that {@link OAuthClient.getAccessToken} should
+     * refresh it.
+     * @default 60
+     */
+    refreshLeeway?: number;
+    /**
+     * The scopes to request by default in {@link OAuthClient.createAuthorizationURL}.
+     * @default none (the application's default scopes)
+     */
+    scopes?: Array<OAuthScope>;
+    /**
+     * A previously obtained token to restore, e.g. one saved from {@link OAuthClientOptions.onToken}.
+     * @default none
+     */
+    token?: OAuthToken | null;
+}
+/** @category OAuth */
+export interface AuthorizationURLOptions {
+    /** Override the code verifier, a random one is generated by default. */
+    codeVerifier?: string;
+    /** Sent as the OpenID Connect `nonce`, included in the returned ID token. */
+    nonce?: string;
+    prompt?: "none" | "login" | "consent" | "select_account";
+    /** @default {@link OAuthClientOptions.redirectURI} */
+    redirectURI?: string;
+    /** @default {@link OAuthClientOptions.scopes} */
+    scopes?: Array<OAuthScope>;
+    /** Override the state, a random one is generated by default. */
+    state?: string;
+}
+/** @category OAuth */
+export interface AuthorizationRequest {
+    /** Must be kept (e.g. in the session) and passed to {@link OAuthClient.exchangeCode} or {@link OAuthClient.handleCallback}. */
+    codeVerifier: string;
+    redirectURI: string | null;
+    /** Must be kept and checked against the callback's state - {@link OAuthClient.handleCallback} does this for you. */
+    state: string;
+    /** The url to send the user to. */
+    url: string;
+}
+/** @category OAuth */
+export interface HandleCallbackOptions {
+    codeVerifier: string;
+    /** @default {@link OAuthClientOptions.redirectURI} */
+    redirectURI?: string;
+    /** The state from {@link AuthorizationRequest.state}, compared against the one in the callback. */
+    state: string;
+}
+/**
+ * A helper for e621's OAuth 2.0 / OpenID Connect flow (authorization code + PKCE). It builds authorization
+ * urls, exchanges codes, and keeps the token refreshed. Pass {@link OAuthClient.getAccessToken} as
+ * {@link Options.authToken} to make requests as the authorized user:
+ * ```ts
+ * const oauth = new OAuthClient({ clientId: "...", redirectURI: "https://example.com/callback", scopes: ["openid", "full"] });
+ * const { url, state, codeVerifier } = await oauth.createAuthorizationURL();
+ * // send the user to `url`, then once they're redirected back:
+ * await oauth.handleCallback(callbackURL, { state, codeVerifier });
+ * const e621 = new E621({ authToken: oauth.getAccessToken });
+ * ```
+ *
+ * OAuth 2.0 / OpenID Connect support is present in the spec but has not been publicly released on e621
+ * yet - these endpoints are not yet available for use.
+ *
+ * @category OAuth
+ */
+export default class OAuthClient {
+    private _clientSecret;
+    private _discovery;
+    private _onToken;
+    private _refreshing;
+    private _token;
+    private _tokenInfo;
+    private _tokens;
+    private _userinfo;
+    readonly baseURL: string;
+    readonly clientId: string;
+    readonly redirectURI: string | null;
+    readonly refreshLeeway: number;
+    readonly scopes: Array<OAuthScope>;
+    constructor(options: OAuthClientOptions);
+    /** Creates a PKCE `code_challenge` (S256) from a code verifier. */
+    static createCodeChallenge(codeVerifier: string): Promise<string>;
+    /** Creates a random PKCE code verifier. */
+    static createCodeVerifier(): string;
+    /** Creates a random state value. */
+    static createState(): string;
+    /** When the current access token expires, as a unix timestamp in milliseconds - `null` if there's no token. */
+    get expiresAt(): number | null;
+    /** Whether the current access token is expired (or within {@link OAuthClientOptions.refreshLeeway} of expiring). */
+    get isExpired(): boolean;
+    /** The current token, if any. */
+    get token(): OAuthToken | null;
+    private _clientAuth;
+    private _requireToken;
+    /** Builds the url to send the user to, to authorize your application. */
+    createAuthorizationURL(options?: AuthorizationURLOptions): Promise<AuthorizationRequest>;
+    /** Gets e621's OpenID Connect discovery document. */
+    discovery(): Promise<OpenIDConfiguration>;
+    /** Exchanges an authorization code for a token, and stores it. */
+    exchangeCode(code: string, codeVerifier: string, redirectURI?: string | null): Promise<OAuthToken>;
+    /**
+     * Gets a valid access token, refreshing it first if it's expired. Already bound, so it can be passed
+     * directly as {@link Options.authToken}.
+     */
+    getAccessToken(): Promise<string>;
+    /**
+     * Validates the url the user was redirected back to (state, and any error e621 sent), then exchanges
+     * its code for a token.
+     * @param callbackURL - The full callback url, or just its query string.
+     */
+    handleCallback(callbackURL: string | URL | URLSearchParams, options: HandleCallbackOptions): Promise<OAuthToken>;
+    /** Introspects a token - by default the current access token. */
+    introspect(token?: string): Promise<OAuthIntrospection>;
+    /**
+     * Refreshes the access token, and stores the new token. Concurrent calls share the same request.
+     * @param scopes - Narrow the new token to these scopes.
+     */
+    refresh(scopes?: Array<OAuthScope>): Promise<OAuthToken>;
+    /** Revokes the current token (which also invalidates its refresh token), and clears it. */
+    revoke(): Promise<void>;
+    /** Replaces the stored token, calling {@link OAuthClientOptions.onToken}. */
+    setToken(token: OAuthToken | null): Promise<void>;
+    /** Gets metadata about the current access token. */
+    tokenInfo(): Promise<OAuthTokenInfo>;
+    /** Gets the OpenID Connect claims of the authorized user, gated by the token's scopes. */
+    userInfo(): Promise<OAuthUserInfo>;
+}

package/dist/lib/OAuthClient.js

@@ -0,0 +1,223 @@
+import { createE621Client } from "./client.js";
+import { OAuthCallbackError } from "./errors.js";
+import DoorkeeperOpenidConnectDiscovery from "./modules/DoorkeeperOpenidConnectDiscovery.js";
+import DoorkeeperOpenidConnectUserinfo from "./modules/DoorkeeperOpenidConnectUserinfo.js";
+import DoorkeeperTokenInfo from "./modules/DoorkeeperTokenInfo.js";
+import DoorkeeperTokens from "./modules/DoorkeeperTokens.js";
+function base64URL(bytes) {
+    let str = "";
+    for (const byte of bytes)
+        str += String.fromCharCode(byte);
+    return btoa(str).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+function randomString(byteLength = 32) {
+    return base64URL(crypto.getRandomValues(new Uint8Array(byteLength)));
+}
+/**
+ * A helper for e621's OAuth 2.0 / OpenID Connect flow (authorization code + PKCE). It builds authorization
+ * urls, exchanges codes, and keeps the token refreshed. Pass {@link OAuthClient.getAccessToken} as
+ * {@link Options.authToken} to make requests as the authorized user:
+ * ```ts
+ * const oauth = new OAuthClient({ clientId: "...", redirectURI: "https://example.com/callback", scopes: ["openid", "full"] });
+ * const { url, state, codeVerifier } = await oauth.createAuthorizationURL();
+ * // send the user to `url`, then once they're redirected back:
+ * await oauth.handleCallback(callbackURL, { state, codeVerifier });
+ * const e621 = new E621({ authToken: oauth.getAccessToken });
+ * ```
+ *
+ * OAuth 2.0 / OpenID Connect support is present in the spec but has not been publicly released on e621
+ * yet - these endpoints are not yet available for use.
+ *
+ * @category OAuth
+ */
+export default class OAuthClient {
+    _clientSecret;
+    _discovery;
+    _onToken;
+    _refreshing;
+    _token;
+    _tokenInfo;
+    _tokens;
+    _userinfo;
+    baseURL;
+    clientId;
+    redirectURI;
+    refreshLeeway;
+    scopes;
+    constructor(options) {
+        const { clientId, clientSecret, onToken, redirectURI, refreshLeeway, scopes, token, ...clientOptions } = options;
+        this.clientId = clientId;
+        this.redirectURI = redirectURI ?? null;
+        this.refreshLeeway = refreshLeeway ?? 60;
+        this.scopes = scopes ?? [];
+        // the token endpoints authenticate the application, never the user, so they get a client without user auth
+        const { client, options: resolved } = createE621Client(clientOptions);
+        const { client: authedClient } = createE621Client({ ...clientOptions, authToken: () => this.getAccessToken() });
+        this.baseURL = resolved.baseURL;
+        Object.defineProperties(this, {
+            _clientSecret: { value: clientSecret ?? null, enumerable: false },
+            _discovery: { value: new DoorkeeperOpenidConnectDiscovery(undefined, client), enumerable: false },
+            _onToken: { value: onToken, enumerable: false },
+            _refreshing: { value: null, writable: true, enumerable: false },
+            _token: { value: token ?? null, writable: true, enumerable: false },
+            _tokenInfo: { value: new DoorkeeperTokenInfo(undefined, authedClient), enumerable: false },
+            _tokens: { value: new DoorkeeperTokens(undefined, client), enumerable: false },
+            _userinfo: { value: new DoorkeeperOpenidConnectUserinfo(undefined, authedClient), enumerable: false },
+        });
+        this.getAccessToken = this.getAccessToken.bind(this);
+    }
+    /** Creates a PKCE `code_challenge` (S256) from a code verifier. */
+    static async createCodeChallenge(codeVerifier) {
+        const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(codeVerifier));
+        return base64URL(new Uint8Array(digest));
+    }
+    /** Creates a random PKCE code verifier. */
+    static createCodeVerifier() {
+        return randomString(32);
+    }
+    /** Creates a random state value. */
+    static createState() {
+        return randomString(16);
+    }
+    /** When the current access token expires, as a unix timestamp in milliseconds - `null` if there's no token. */
+    get expiresAt() {
+        if (this._token === null)
+            return null;
+        return (this._token.created_at + this._token.expires_in) * 1000;
+    }
+    /** Whether the current access token is expired (or within {@link OAuthClientOptions.refreshLeeway} of expiring). */
+    get isExpired() {
+        const expiresAt = this.expiresAt;
+        return expiresAt === null || Date.now() >= expiresAt - this.refreshLeeway * 1000;
+    }
+    /** The current token, if any. */
+    get token() {
+        return this._token;
+    }
+    _clientAuth() {
+        return this._clientSecret === null ? { client_id: this.clientId } : { client_id: this.clientId, client_secret: this._clientSecret };
+    }
+    _requireToken() {
+        if (this._token === null)
+            throw new Error("No OAuth token is available, the user must authorize first.");
+        return this._token;
+    }
+    /** Builds the url to send the user to, to authorize your application. */
+    async createAuthorizationURL(options = {}) {
+        const codeVerifier = options.codeVerifier ?? OAuthClient.createCodeVerifier();
+        const state = options.state ?? OAuthClient.createState();
+        const redirectURI = options.redirectURI ?? this.redirectURI;
+        const scopes = options.scopes ?? this.scopes;
+        const url = new URL("/oauth/authorize", this.baseURL);
+        url.searchParams.set("response_type", "code");
+        url.searchParams.set("client_id", this.clientId);
+        if (redirectURI)
+            url.searchParams.set("redirect_uri", redirectURI);
+        if (scopes.length !== 0)
+            url.searchParams.set("scope", scopes.join(" "));
+        url.searchParams.set("state", state);
+        url.searchParams.set("code_challenge", await OAuthClient.createCodeChallenge(codeVerifier));
+        url.searchParams.set("code_challenge_method", "S256");
+        if (options.nonce)
+            url.searchParams.set("nonce", options.nonce);
+        if (options.prompt)
+            url.searchParams.set("prompt", options.prompt);
+        return { codeVerifier, redirectURI, state, url: url.toString() };
+    }
+    /** Gets e621's OpenID Connect discovery document. */
+    async discovery() {
+        return this._discovery.provider();
+    }
+    /** Exchanges an authorization code for a token, and stores it. */
+    async exchangeCode(code, codeVerifier, redirectURI = this.redirectURI) {
+        const token = await this._tokens.create({
+            grant_type: "authorization_code",
+            code,
+            code_verifier: codeVerifier,
+            redirect_uri: redirectURI ?? undefined,
+            ...this._clientAuth(),
+        });
+        await this.setToken(token);
+        return token;
+    }
+    /**
+     * Gets a valid access token, refreshing it first if it's expired. Already bound, so it can be passed
+     * directly as {@link Options.authToken}.
+     */
+    async getAccessToken() {
+        if (this._token === null)
+            throw new Error("No OAuth token is available, the user must authorize first.");
+        if (this.isExpired)
+            return (await this.refresh()).access_token;
+        return this._token.access_token;
+    }
+    /**
+     * Validates the url the user was redirected back to (state, and any error e621 sent), then exchanges
+     * its code for a token.
+     * @param callbackURL - The full callback url, or just its query string.
+     */
+    async handleCallback(callbackURL, options) {
+        const params = callbackURL instanceof URLSearchParams
+            ? callbackURL
+            : typeof callbackURL === "string" && !/^[a-z][\d+.a-z-]*:/i.test(callbackURL)
+                ? new URLSearchParams(callbackURL)
+                : new URL(callbackURL).searchParams;
+        const state = params.get("state");
+        const error = params.get("error");
+        if (error)
+            throw new OAuthCallbackError(error, params.get("error_description"), state);
+        if (state !== options.state)
+            throw new OAuthCallbackError("invalid_state", "The callback's state does not match the expected state.", state);
+        const code = params.get("code");
+        if (!code)
+            throw new OAuthCallbackError("invalid_request", "The callback is missing the authorization code.", state);
+        return this.exchangeCode(code, options.codeVerifier, options.redirectURI ?? this.redirectURI);
+    }
+    /** Introspects a token - by default the current access token. */
+    async introspect(token = this._requireToken().access_token) {
+        return this._tokens.introspect({ token, ...this._clientAuth() });
+    }
+    /**
+     * Refreshes the access token, and stores the new token. Concurrent calls share the same request.
+     * @param scopes - Narrow the new token to these scopes.
+     */
+    async refresh(scopes) {
+        if (this._refreshing)
+            return this._refreshing;
+        const refreshToken = this._requireToken().refresh_token;
+        this._refreshing = this._tokens.create({
+            grant_type: "refresh_token",
+            refresh_token: refreshToken,
+            scope: scopes?.join(" "),
+            ...this._clientAuth(),
+        })
+            .then(async (token) => {
+            await this.setToken(token);
+            return token;
+        })
+            .finally(() => {
+            this._refreshing = null;
+        });
+        return this._refreshing;
+    }
+    /** Revokes the current token (which also invalidates its refresh token), and clears it. */
+    async revoke() {
+        const token = this._requireToken();
+        await this._tokens.revoke({ token: token.access_token, token_type_hint: "access_token", ...this._clientAuth() });
+        await this.setToken(null);
+    }
+    /** Replaces the stored token, calling {@link OAuthClientOptions.onToken}. */
+    async setToken(token) {
+        this._token = token;
+        await this._onToken?.(token);
+    }
+    /** Gets metadata about the current access token. */
+    async tokenInfo() {
+        return this._tokenInfo.get();
+    }
+    /** Gets the OpenID Connect claims of the authorized user, gated by the token's scopes. */
+    async userInfo() {
+        return this._userinfo.get();
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiT0F1dGhDbGllbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9saWIvT0F1dGhDbGllbnQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLGdCQUFnQixFQUFnQixNQUFNLGFBQWEsQ0FBQztBQUM3RCxPQUFPLEVBQUUsa0JBQWtCLEVBQUUsTUFBTSxhQUFhLENBQUM7QUFDakQsT0FBTyxnQ0FBZ0MsTUFBTSwrQ0FBK0MsQ0FBQztBQUM3RixPQUFPLCtCQUErQixNQUFNLDhDQUE4QyxDQUFDO0FBQzNGLE9BQU8sbUJBQW1CLE1BQU0sa0NBQWtDLENBQUM7QUFDbkUsT0FBTyxnQkFBZ0IsTUFBTSwrQkFBK0IsQ0FBQztBQXNGN0QsU0FBUyxTQUFTLENBQUMsS0FBaUI7SUFDaEMsSUFBSSxHQUFHLEdBQUcsRUFBRSxDQUFDO0lBQ2IsS0FBSyxNQUFNLElBQUksSUFBSSxLQUFLO1FBQUUsR0FBRyxJQUFJLE1BQU0sQ0FBQyxZQUFZLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDM0QsT0FBTyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsVUFBVSxDQUFDLEdBQUcsRUFBRSxHQUFHLENBQUMsQ0FBQyxVQUFVLENBQUMsR0FBRyxFQUFFLEdBQUcsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7QUFDbEYsQ0FBQztBQUVELFNBQVMsWUFBWSxDQUFDLFVBQVUsR0FBRyxFQUFFO0lBQ2pDLE9BQU8sU0FBUyxDQUFDLE1BQU0sQ0FBQyxlQUFlLENBQUMsSUFBSSxVQUFVLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBQ3pFLENBQUM7QUFFRDs7Ozs7Ozs7Ozs7Ozs7OztHQWdCRztBQUNILE1BQU0sQ0FBQyxPQUFPLE9BQU8sV0FBVztJQUNwQixhQUFhLENBQWlCO0lBQzlCLFVBQVUsQ0FBb0M7SUFDOUMsUUFBUSxDQUFpQztJQUN6QyxXQUFXLENBQThCO0lBQ3pDLE1BQU0sQ0FBcUI7SUFDM0IsVUFBVSxDQUF1QjtJQUNqQyxPQUFPLENBQW9CO0lBQzNCLFNBQVMsQ0FBbUM7SUFDM0MsT0FBTyxDQUFTO0lBQ2hCLFFBQVEsQ0FBUztJQUNqQixXQUFXLENBQWdCO0lBQzNCLGFBQWEsQ0FBUztJQUN0QixNQUFNLENBQW9CO0lBQ25DLFlBQVksT0FBMkI7UUFDbkMsTUFBTSxFQUFFLFFBQVEsRUFBRSxZQUFZLEVBQUUsT0FBTyxFQUFFLFdBQVcsRUFBRSxhQUFhLEVBQUUsTUFBTSxFQUFFLEtBQUssRUFBRSxHQUFHLGFBQWEsRUFBRSxHQUFHLE9BQU8sQ0FBQztRQUNqSCxJQUFJLENBQUMsUUFBUSxHQUFHLFFBQVEsQ0FBQztRQUN6QixJQUFJLENBQUMsV0FBVyxHQUFHLFdBQVcsSUFBSSxJQUFJLENBQUM7UUFDdkMsSUFBSSxDQUFDLGFBQWEsR0FBRyxhQUFhLElBQUksRUFBRSxDQUFDO1FBQ3pDLElBQUksQ0FBQyxNQUFNLEdBQUcsTUFBTSxJQUFJLEVBQUUsQ0FBQztRQUMzQiwyR0FBMkc7UUFDM0csTUFBTSxFQUFFLE1BQU0sRUFBRSxPQUFPLEVBQUUsUUFBUSxFQUFFLEdBQUcsZ0JBQWdCLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDdEUsTUFBTSxFQUFFLE1BQU0sRUFBRSxZQUFZLEVBQUUsR0FBRyxnQkFBZ0IsQ0FBQyxFQUFFLEdBQUcsYUFBYSxFQUFFLFNBQVMsRUFBRSxHQUFHLEVBQUUsQ0FBQyxJQUFJLENBQUMsY0FBYyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQ2hILElBQUksQ0FBQyxPQUFPLEdBQUcsUUFBUSxDQUFDLE9BQU8sQ0FBQztRQUNoQyxNQUFNLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxFQUFFO1lBQzFCLGFBQWEsRUFBRSxFQUFFLEtBQUssRUFBRSxZQUFZLElBQUksSUFBSSxFQUFFLFVBQVUsRUFBRSxLQUFLLEVBQUU7WUFDakUsVUFBVSxFQUFFLEVBQUUsS0FBSyxFQUFFLElBQUksZ0NBQWdDLENBQUMsU0FBUyxFQUFFLE1BQU0sQ0FBQyxFQUFFLFVBQVUsRUFBRSxLQUFLLEVBQUU7WUFDakcsUUFBUSxFQUFFLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxVQUFVLEVBQUUsS0FBSyxFQUFFO1lBQy9DLFdBQVcsRUFBRSxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsUUFBUSxFQUFFLElBQUksRUFBRSxVQUFVLEVBQUUsS0FBSyxFQUFFO1lBQy9ELE1BQU0sRUFBRSxFQUFFLEtBQUssRUFBRSxLQUFLLElBQUksSUFBSSxFQUFFLFFBQVEsRUFBRSxJQUFJLEVBQUUsVUFBVSxFQUFFLEtBQUssRUFBRTtZQUNuRSxVQUFVLEVBQUUsRUFBRSxLQUFLLEVBQUUsSUFBSSxtQkFBbUIsQ0FBQyxTQUFTLEVBQUUsWUFBWSxDQUFDLEVBQUUsVUFBVSxFQUFFLEtBQUssRUFBRTtZQUMxRixPQUFPLEVBQUUsRUFBRSxLQUFLLEVBQUUsSUFBSSxnQkFBZ0IsQ0FBQyxTQUFTLEVBQUUsTUFBTSxDQUFDLEVBQUUsVUFBVSxFQUFFLEtBQUssRUFBRTtZQUM5RSxTQUFTLEVBQUUsRUFBRSxLQUFLLEVBQUUsSUFBSSwrQkFBK0IsQ0FBQyxTQUFTLEVBQUUsWUFBWSxDQUFDLEVBQUUsVUFBVSxFQUFFLEtBQUssRUFBRTtTQUN4RyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsY0FBYyxHQUFHLElBQUksQ0FBQyxjQUFjLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ3pELENBQUM7SUFFRCxtRUFBbUU7SUFDbkUsTUFBTSxDQUFDLEtBQUssQ0FBQyxtQkFBbUIsQ0FBQyxZQUFvQjtRQUNqRCxNQUFNLE1BQU0sR0FBRyxNQUFNLE1BQU0sQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFNBQVMsRUFBRSxJQUFJLFdBQVcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDO1FBQzdGLE9BQU8sU0FBUyxDQUFDLElBQUksVUFBVSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFDN0MsQ0FBQztJQUVELDJDQUEyQztJQUMzQyxNQUFNLENBQUMsa0JBQWtCO1FBQ3JCLE9BQU8sWUFBWSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQzVCLENBQUM7SUFFRCxvQ0FBb0M7SUFDcEMsTUFBTSxDQUFDLFdBQVc7UUFDZCxPQUFPLFlBQVksQ0FBQyxFQUFFLENBQUMsQ0FBQztJQUM1QixDQUFDO0lBRUQsK0dBQStHO0lBQy9HLElBQUksU0FBUztRQUNULElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxJQUFJO1lBQUUsT0FBTyxJQUFJLENBQUM7UUFDdEMsT0FBTyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsVUFBVSxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLEdBQUcsSUFBSSxDQUFDO0lBQ3BFLENBQUM7SUFFRCxvSEFBb0g7SUFDcEgsSUFBSSxTQUFTO1FBQ1QsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUNqQyxPQUFPLFNBQVMsS0FBSyxJQUFJLElBQUksSUFBSSxDQUFDLEdBQUcsRUFBRSxJQUFJLFNBQVMsR0FBRyxJQUFJLENBQUMsYUFBYSxHQUFHLElBQUksQ0FBQztJQUNyRixDQUFDO0lBRUQsaUNBQWlDO0lBQ2pDLElBQUksS0FBSztRQUNMLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQztJQUN2QixDQUFDO0lBRU8sV0FBVztRQUNmLE9BQU8sSUFBSSxDQUFDLGFBQWEsS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsU0FBUyxFQUFFLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxTQUFTLEVBQUUsSUFBSSxDQUFDLFFBQVEsRUFBRSxhQUFhLEVBQUUsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO0lBQ3hJLENBQUM7SUFFTyxhQUFhO1FBQ2pCLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxJQUFJO1lBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyw2REFBNkQsQ0FBQyxDQUFDO1FBQ3pHLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQztJQUN2QixDQUFDO0lBRUQseUVBQXlFO0lBQ3pFLEtBQUssQ0FBQyxzQkFBc0IsQ0FBQyxVQUFtQyxFQUFFO1FBQzlELE1BQU0sWUFBWSxHQUFHLE9BQU8sQ0FBQyxZQUFZLElBQUksV0FBVyxDQUFDLGtCQUFrQixFQUFFLENBQUM7UUFDOUUsTUFBTSxLQUFLLEdBQUcsT0FBTyxDQUFDLEtBQUssSUFBSSxXQUFXLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDekQsTUFBTSxXQUFXLEdBQUcsT0FBTyxDQUFDLFdBQVcsSUFBSSxJQUFJLENBQUMsV0FBVyxDQUFDO1FBQzVELE1BQU0sTUFBTSxHQUFHLE9BQU8sQ0FBQyxNQUFNLElBQUksSUFBSSxDQUFDLE1BQU0sQ0FBQztRQUM3QyxNQUFNLEdBQUcsR0FBRyxJQUFJLEdBQUcsQ0FBQyxrQkFBa0IsRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDdEQsR0FBRyxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsZUFBZSxFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBQzlDLEdBQUcsQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLFdBQVcsRUFBRSxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDakQsSUFBSSxXQUFXO1lBQUUsR0FBRyxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsY0FBYyxFQUFFLFdBQVcsQ0FBQyxDQUFDO1FBQ25FLElBQUksTUFBTSxDQUFDLE1BQU0sS0FBSyxDQUFDO1lBQUUsR0FBRyxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztRQUN6RSxHQUFHLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxPQUFPLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFDckMsR0FBRyxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsZ0JBQWdCLEVBQUUsTUFBTSxXQUFXLENBQUMsbUJBQW1CLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQztRQUM1RixHQUFHLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyx1QkFBdUIsRUFBRSxNQUFNLENBQUMsQ0FBQztRQUN0RCxJQUFJLE9BQU8sQ0FBQyxLQUFLO1lBQUUsR0FBRyxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsT0FBTyxFQUFFLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNoRSxJQUFJLE9BQU8sQ0FBQyxNQUFNO1lBQUUsR0FBRyxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsUUFBUSxFQUFFLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUVuRSxPQUFPLEVBQUUsWUFBWSxFQUFFLFdBQVcsRUFBRSxLQUFLLEVBQUUsR0FBRyxFQUFFLEdBQUcsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDO0lBQ3JFLENBQUM7SUFFRCxxREFBcUQ7SUFDckQsS0FBSyxDQUFDLFNBQVM7UUFDWCxPQUFPLElBQUksQ0FBQyxVQUFVLENBQUMsUUFBUSxFQUFFLENBQUM7SUFDdEMsQ0FBQztJQUVELGtFQUFrRTtJQUNsRSxLQUFLLENBQUMsWUFBWSxDQUFDLElBQVksRUFBRSxZQUFvQixFQUFFLGNBQTZCLElBQUksQ0FBQyxXQUFXO1FBQ2hHLE1BQU0sS0FBSyxHQUFHLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUM7WUFDcEMsVUFBVSxFQUFFLG9CQUFvQjtZQUNoQyxJQUFJO1lBQ0osYUFBYSxFQUFFLFlBQVk7WUFDM0IsWUFBWSxFQUFFLFdBQVcsSUFBSSxTQUFTO1lBQ3RDLEdBQUcsSUFBSSxDQUFDLFdBQVcsRUFBRTtTQUN4QixDQUFDLENBQUM7UUFDSCxNQUFNLElBQUksQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDM0IsT0FBTyxLQUFLLENBQUM7SUFDakIsQ0FBQztJQUVEOzs7T0FHRztJQUNILEtBQUssQ0FBQyxjQUFjO1FBQ2hCLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxJQUFJO1lBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyw2REFBNkQsQ0FBQyxDQUFDO1FBQ3pHLElBQUksSUFBSSxDQUFDLFNBQVM7WUFBRSxPQUFPLENBQUMsTUFBTSxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQyxZQUFZLENBQUM7UUFDL0QsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFlBQVksQ0FBQztJQUNwQyxDQUFDO0lBRUQ7Ozs7T0FJRztJQUNILEtBQUssQ0FBQyxjQUFjLENBQUMsV0FBMkMsRUFBRSxPQUE4QjtRQUM1RixNQUFNLE1BQU0sR0FBRyxXQUFXLFlBQVksZUFBZTtZQUNqRCxDQUFDLENBQUMsV0FBVztZQUNiLENBQUMsQ0FBQyxPQUFPLFdBQVcsS0FBSyxRQUFRLElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDO2dCQUN6RSxDQUFDLENBQUMsSUFBSSxlQUFlLENBQUMsV0FBVyxDQUFDO2dCQUNsQyxDQUFDLENBQUMsSUFBSSxHQUFHLENBQUMsV0FBVyxDQUFDLENBQUMsWUFBWSxDQUFDO1FBQzVDLE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDbEMsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUNsQyxJQUFJLEtBQUs7WUFBRSxNQUFNLElBQUksa0JBQWtCLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxHQUFHLENBQUMsbUJBQW1CLENBQUMsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUN2RixJQUFJLEtBQUssS0FBSyxPQUFPLENBQUMsS0FBSztZQUFFLE1BQU0sSUFBSSxrQkFBa0IsQ0FBQyxlQUFlLEVBQUUseURBQXlELEVBQUUsS0FBSyxDQUFDLENBQUM7UUFDN0ksTUFBTSxJQUFJLEdBQUcsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUNoQyxJQUFJLENBQUMsSUFBSTtZQUFFLE1BQU0sSUFBSSxrQkFBa0IsQ0FBQyxpQkFBaUIsRUFBRSxpREFBaUQsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUNySCxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsSUFBSSxFQUFFLE9BQU8sQ0FBQyxZQUFZLEVBQUUsT0FBTyxDQUFDLFdBQVcsSUFBSSxJQUFJLENBQUMsV0FBVyxDQUFDLENBQUM7SUFDbEcsQ0FBQztJQUVELGlFQUFpRTtJQUNqRSxLQUFLLENBQUMsVUFBVSxDQUFDLEtBQUssR0FBRyxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUMsWUFBWTtRQUN0RCxPQUFPLElBQUksQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLEVBQUUsS0FBSyxFQUFFLEdBQUcsSUFBSSxDQUFDLFdBQVcsRUFBRSxFQUFFLENBQUMsQ0FBQztJQUNyRSxDQUFDO0lBRUQ7OztPQUdHO0lBQ0gsS0FBSyxDQUFDLE9BQU8sQ0FBQyxNQUEwQjtRQUNwQyxJQUFJLElBQUksQ0FBQyxXQUFXO1lBQUUsT0FBTyxJQUFJLENBQUMsV0FBVyxDQUFDO1FBQzlDLE1BQU0sWUFBWSxHQUFHLElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQyxhQUFhLENBQUM7UUFDeEQsSUFBSSxDQUFDLFdBQVcsR0FBRyxJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQztZQUNuQyxVQUFVLEVBQUUsZUFBZTtZQUMzQixhQUFhLEVBQUUsWUFBWTtZQUMzQixLQUFLLEVBQUUsTUFBTSxFQUFFLElBQUksQ0FBQyxHQUFHLENBQUM7WUFDeEIsR0FBRyxJQUFJLENBQUMsV0FBVyxFQUFFO1NBQ3hCLENBQUM7YUFDRyxJQUFJLENBQUMsS0FBSyxFQUFFLEtBQUssRUFBRSxFQUFFO1lBQ2xCLE1BQU0sSUFBSSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUMzQixPQUFPLEtBQUssQ0FBQztRQUNqQixDQUFDLENBQUM7YUFDRCxPQUFPLENBQUMsR0FBRyxFQUFFO1lBQ1YsSUFBSSxDQUFDLFdBQVcsR0FBRyxJQUFJLENBQUM7UUFDNUIsQ0FBQyxDQUFDLENBQUM7UUFDUCxPQUFPLElBQUksQ0FBQyxXQUFXLENBQUM7SUFDNUIsQ0FBQztJQUVELDJGQUEyRjtJQUMzRixLQUFLLENBQUMsTUFBTTtRQUNSLE1BQU0sS0FBSyxHQUFHLElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNuQyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLEVBQUUsS0FBSyxFQUFFLEtBQUssQ0FBQyxZQUFZLEVBQUUsZUFBZSxFQUFFLGNBQWMsRUFBRSxHQUFHLElBQUksQ0FBQyxXQUFXLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFDakgsTUFBTSxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQzlCLENBQUM7SUFFRCw2RUFBNkU7SUFDN0UsS0FBSyxDQUFDLFFBQVEsQ0FBQyxLQUF3QjtRQUNuQyxJQUFJLENBQUMsTUFBTSxHQUFHLEtBQUssQ0FBQztRQUNwQixNQUFNLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUNqQyxDQUFDO0lBRUQsb0RBQW9EO0lBQ3BELEtBQUssQ0FBQyxTQUFTO1FBQ1gsT0FBTyxJQUFJLENBQUMsVUFBVSxDQUFDLEdBQUcsRUFBRSxDQUFDO0lBQ2pDLENBQUM7SUFFRCwwRkFBMEY7SUFDMUYsS0FBSyxDQUFDLFFBQVE7UUFDVixPQUFPLElBQUksQ0FBQyxTQUFTLENBQUMsR0FBRyxFQUFFLENBQUM7SUFDaEMsQ0FBQztDQUNKIn0=

package/dist/lib/client.d.ts

@@ -1,6 +1,59 @@
 import type { Client } from "./generated/client/types.js";
 import type { NoV2Options, PostFormatOptions } from "./modules/posts/Format.js";
 /** @category Main */
+export interface RatelimitInfo {
+    /** The 1-indexed attempt that just got rate limited. */
+    attempt: number;
+    /** The configured {@link RatelimitOptions.maxRetries}, for context. */
+    maxRetries: number;
+    request: Request;
+    response: Response;
+    /** Seconds parsed from the response's `Retry-After` header - `null` if missing/unparsable. */
+    retryAfter: number | null;
+    /** Whether this request will be retried, or is about to fail with a {@link RatelimitError}. */
+    willRetry: boolean;
+}
+/** @category Main */
+export interface RatelimitOptions {
+    /**
+     * The maximum number of times to retry a rate limited (HTTP 429) request before giving up and
+     * throwing a {@link RatelimitError}.
+     * @default 3
+     */
+    maxRetries?: number;
+    /**
+     * The maximum delay, in seconds, to wait before retrying, regardless of what the `Retry-After` header
+     * says or how many attempts have been made.
+     * @default 60
+     */
+    maxRetryDelay?: number;
+    /**
+     * Called every time a request gets rate limited, before the retry delay (or before throwing, if
+     * retries are exhausted or disabled). Useful for logging/metrics.
+     * @default none
+     */
+    onRatelimit?: (info: RatelimitInfo) => void;
+    /**
+     * Whether to automatically retry requests that get rate limited (HTTP 429), waiting for the duration
+     * in the response's `Retry-After` header (or `retryDelay`, backed off exponentially per attempt, if
+     * the header is missing or unusable) before retrying.
+     * @default true
+     */
+    retry?: boolean;
+    /**
+     * The delay, in seconds, to wait before retrying a rate limited request when the response has no (or
+     * an unusable) `Retry-After` header. Doubled per attempt (capped at `maxRetryDelay`).
+     * @default 1
+     */
+    retryDelay?: number;
+}
+/**
+ * A bearer token, or a function returning one (e.g. {@link OAuthClient.getAccessToken}, to refresh tokens
+ * as they expire). Returning `null`/`undefined` sends the request without bearer auth.
+ * @category Main
+ */
+export type AuthToken = string | (() => string | null | undefined | Promise<string | null | undefined>);
+/** @category Main */
 export interface Options<PF extends PostFormatOptions = NoV2Options> {
     /**
      * The api key you want to authenticate with (Account -> Manage API Access)
@@ -8,7 +61,13 @@ export interface Options<PF extends PostFormatOptions = NoV2Options> {
      */
     authKey?: string;
     /**
-     * The uername of the user you want to authenticate with
+     * A bearer token (such as an OAuth access token) to authenticate with, or a function that returns one.
+     * Takes priority over {@link Options.authUser}/{@link Options.authKey} when both are provided.
+     * @default none
+     */
+    authToken?: AuthToken;
+    /**
+     * The username of the user you want to authenticate with
      * @default none
      */
     authUser?: string;
@@ -25,6 +84,11 @@ export interface Options<PF extends PostFormatOptions = NoV2Options> {
      * @default legacy (v2: false)
      */
     defaultPostFormat?: PF;
+    /**
+     * Controls how rate limited (HTTP 429) requests are retried.
+     * @default \{ retry: true, maxRetries: 3, retryDelay: 1, maxRetryDelay: 60 \}
+     */
+    ratelimit?: RatelimitOptions;
     /**
      * The number of seconds before a request times out
      * @default 30
@@ -49,10 +113,20 @@ export interface Options<PF extends PostFormatOptions = NoV2Options> {
     userAgentInQuery?: boolean;
 }
 /** @category Main */
+export interface ResolvedRatelimitOptions {
+    maxRetries: number;
+    maxRetryDelay: number;
+    onRatelimit?: (info: RatelimitInfo) => void;
+    retry: boolean;
+    retryDelay: number;
+}
+/** @category Main */
 export interface InstanceOptions {
     authKey: string | null;
+    authToken: AuthToken | null;
     authUser: string | null;
     baseURL: string;
+    ratelimit: ResolvedRatelimitOptions;
     requestTimeout: number;
     statusCheckURL: string;
     userAgent: string;

package/dist/lib/client.js

@@ -1,4 +1,5 @@
 import Debug from "./Debug.js";
+import { parseRetryAfter } from "./errors.js";
 import { createClient } from "./generated/client/client.js";
 import { createConfig } from "./generated/client/utils.js";
 import { VERSION } from "./version.js";
@@ -14,39 +15,59 @@ import { VERSION } from "./version.js";
 export function createE621Client(options) {
     const resolved = {
         authKey: options?.authKey ?? null,
+        authToken: options?.authToken ?? null,
         authUser: options?.authUser ?? null,
         baseURL: options?.baseURL ?? "https://e621.net",
+        ratelimit: {
+            maxRetries: options?.ratelimit?.maxRetries ?? 3,
+            maxRetryDelay: options?.ratelimit?.maxRetryDelay ?? 60,
+            onRatelimit: options?.ratelimit?.onRatelimit,
+            retry: options?.ratelimit?.retry ?? true,
+            retryDelay: options?.ratelimit?.retryDelay ?? 1,
+        },
         requestTimeout: options?.requestTimeout ?? 30,
         statusCheckURL: options?.statusCheckURL ?? "https://status.e621.church/json",
         userAgent: options?.userAgent ?? `E621/${VERSION} (https://github.com/DonovanDMC/E621${options?.authUser ? `; "${options.authUser}"` : ""})`,
         userAgentInQuery: options?.userAgentInQuery ?? "window" in globalThis,
     };
-    let config;
-    const commonConfig = {
+    // read at request time, so changing options.authToken etc. after construction still takes effect
+    const getAuthorization = async () => {
+        if (resolved.authToken) {
+            const token = typeof resolved.authToken === "function" ? await resolved.authToken() : resolved.authToken;
+            if (token)
+                return `Bearer ${token}`;
+        }
+        if (resolved.authKey && resolved.authUser)
+            return `Basic ${btoa(`${resolved.authUser}:${resolved.authKey}`)}`;
+        return null;
+    };
+    const config = createConfig({
         baseUrl: resolved.baseURL,
         headers: resolved.userAgentInQuery ? undefined : {
             "User-Agent": resolved.userAgent,
         },
         fetch: async (input, init) => {
             let url = "unknown", method = "unknown";
-            // for some reason it doesn't seem to be inserting the Authorization header
+            // the generated client only inserts auth for operations with a matching security scheme, so it's done here instead
             if (input instanceof Request) {
                 url = input.url;
                 method = input.method.toLowerCase();
-                if (!input.headers.has("Auithorization") && resolved.authKey && resolved.authUser) {
-                    input.headers.set("Authorization", `Basic ${btoa(`${resolved.authUser}:${resolved.authKey}`)}`);
+                if (!input.headers.has("Authorization")) {
+                    const authorization = await getAuthorization();
+                    if (authorization)
+                        input.headers.set("Authorization", authorization);
                 }
             }
             else if (init) {
                 url = input.toString();
                 method = init.method?.toLowerCase() ?? "get";
-                if (resolved.authKey && resolved.authUser) {
-                    const headers = new Headers(init.headers);
-                    if (!headers.has("Authorization")) {
-                        headers.set("Authorization", `Basic ${btoa(`${resolved.authUser}:${resolved.authKey}`)}`);
-                    }
-                    init.headers = headers;
+                const headers = new Headers(init.headers);
+                if (!headers.has("Authorization")) {
+                    const authorization = await getAuthorization();
+                    if (authorization)
+                        headers.set("Authorization", authorization);
                 }
+                init.headers = headers;
             }
             if (resolved.userAgentInQuery && input instanceof Request) {
                 const requestURL = new URL(input.url);
@@ -55,25 +76,36 @@ export function createE621Client(options) {
                 url = requestURL.toString();
             }
             Debug(`request:${method}`, `-> ${url}`);
-            const res = await fetch(input, init);
-            Debug(`response:${method}`, `<- ${url} ${res.status} ${res.statusText}`);
+            let attempt = 0, res;
+            for (;;) {
+                // clone so a retry can re-send the body - `input` itself is never fetched directly, so it's
+                // never disturbed and can be cloned again on the next attempt
+                res = await fetch(input instanceof Request ? input.clone() : input, init);
+                Debug(`response:${method}`, `<- ${url} ${res.status} ${res.statusText}`);
+                if (res.status !== 429)
+                    break;
+                const retryAfter = parseRetryAfter(res);
+                const willRetry = resolved.ratelimit.retry && attempt < resolved.ratelimit.maxRetries;
+                resolved.ratelimit.onRatelimit?.({
+                    attempt: attempt + 1,
+                    maxRetries: resolved.ratelimit.maxRetries,
+                    request: input instanceof Request ? input : new Request(url, init),
+                    response: res,
+                    retryAfter,
+                    willRetry,
+                });
+                if (!willRetry)
+                    break;
+                const delay = Math.min(retryAfter ?? resolved.ratelimit.retryDelay * 2 ** attempt, resolved.ratelimit.maxRetryDelay);
+                Debug(`response:${method}`, `<- ${url} ratelimited, retrying in ${delay}s (attempt ${attempt + 1}/${resolved.ratelimit.maxRetries})`);
+                // free the connection, the body of a response we're discarding is never read
+                await res.body?.cancel().catch(() => { });
+                await new Promise(resolve => setTimeout(resolve, delay * 1000));
+                attempt++;
+            }
             return res;
         },
-    };
-    if (resolved.authKey && resolved.authUser) {
-        config = createConfig({
-            ...commonConfig,
-            auth: (auth) => {
-                if (auth.scheme === "basic") {
-                    return `${resolved.authUser}:${resolved.authKey}`;
-                }
-                return;
-            },
-        });
-    }
-    else {
-        config = createConfig(commonConfig);
-    }
+    });
     return { client: createClient(config), options: resolved };
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xpZW50LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vbGliL2NsaWVudC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssTUFBTSxZQUFZLENBQUM7QUFDL0IsT0FBTyxFQUFFLFlBQVksRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBQzVELE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSw2QkFBNkIsQ0FBQztBQUMzRCxPQUFPLEVBQUUsT0FBTyxFQUFFLE1BQU0sY0FBYyxDQUFDO0FBdUV2Qzs7Ozs7Ozs7R0FRRztBQUNILE1BQU0sVUFBVSxnQkFBZ0IsQ0FBbUQsT0FBcUI7SUFDcEcsTUFBTSxRQUFRLEdBQW9CO1FBQzlCLE9BQU8sRUFBRSxPQUFPLEVBQUUsT0FBTyxJQUFJLElBQUk7UUFDakMsUUFBUSxFQUFFLE9BQU8sRUFBRSxRQUFRLElBQUksSUFBSTtRQUNuQyxPQUFPLEVBQUUsT0FBTyxFQUFFLE9BQU8sSUFBSSxrQkFBa0I7UUFDL0MsY0FBYyxFQUFFLE9BQU8sRUFBRSxjQUFjLElBQUksRUFBRTtRQUM3QyxjQUFjLEVBQUUsT0FBTyxFQUFFLGNBQWMsSUFBSSxpQ0FBaUM7UUFDNUUsU0FBUyxFQUFFLE9BQU8sRUFBRSxTQUFTLElBQUksUUFBUSxPQUFPLHVDQUF1QyxPQUFPLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQyxNQUFNLE9BQU8sQ0FBQyxRQUFRLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxHQUFHO1FBQzVJLGdCQUFnQixFQUFFLE9BQU8sRUFBRSxnQkFBZ0IsSUFBSSxRQUFRLElBQUksVUFBVTtLQUN4RSxDQUFDO0lBQ0YsSUFBSSxNQUFjLENBQUM7SUFDbkIsTUFBTSxZQUFZLEdBQWdEO1FBQzlELE9BQU8sRUFBRSxRQUFRLENBQUMsT0FBTztRQUN6QixPQUFPLEVBQUUsUUFBUSxDQUFDLGdCQUFnQixDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDO1lBQzdDLFlBQVksRUFBRSxRQUFRLENBQUMsU0FBUztTQUNuQztRQUNELEtBQUssRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBcUIsRUFBRTtZQUM1QyxJQUFJLEdBQUcsR0FBRyxTQUFTLEVBQUUsTUFBTSxHQUFHLFNBQVMsQ0FBQztZQUN4QywyRUFBMkU7WUFDM0UsSUFBSSxLQUFLLFlBQVksT0FBTyxFQUFFLENBQUM7Z0JBQzNCLEdBQUcsR0FBRyxLQUFLLENBQUMsR0FBRyxDQUFDO2dCQUNoQixNQUFNLEdBQUcsS0FBSyxDQUFDLE1BQU0sQ0FBQyxXQUFXLEVBQUUsQ0FBQztnQkFDcEMsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLGdCQUFnQixDQUFDLElBQUksUUFBUSxDQUFDLE9BQU8sSUFBSSxRQUFRLENBQUMsUUFBUSxFQUFFLENBQUM7b0JBQ2hGLEtBQUssQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLGVBQWUsRUFBRSxTQUFTLElBQUksQ0FBQyxHQUFHLFFBQVEsQ0FBQyxRQUFRLElBQUksUUFBUSxDQUFDLE9BQU8sRUFBRSxDQUFDLEVBQUUsQ0FBQyxDQUFDO2dCQUNwRyxDQUFDO1lBQ0wsQ0FBQztpQkFBTSxJQUFJLElBQUksRUFBRSxDQUFDO2dCQUNkLEdBQUcsR0FBRyxLQUFLLENBQUMsUUFBUSxFQUFFLENBQUM7Z0JBQ3ZCLE1BQU0sR0FBRyxJQUFJLENBQUMsTUFBTSxFQUFFLFdBQVcsRUFBRSxJQUFJLEtBQUssQ0FBQztnQkFDN0MsSUFBSSxRQUFRLENBQUMsT0FBTyxJQUFJLFFBQVEsQ0FBQyxRQUFRLEVBQUUsQ0FBQztvQkFDeEMsTUFBTSxPQUFPLEdBQUcsSUFBSSxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDO29CQUMxQyxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxlQUFlLENBQUMsRUFBRSxDQUFDO3dCQUNoQyxPQUFPLENBQUMsR0FBRyxDQUFDLGVBQWUsRUFBRSxTQUFTLElBQUksQ0FBQyxHQUFHLFFBQVEsQ0FBQyxRQUFRLElBQUksUUFBUSxDQUFDLE9BQU8sRUFBRSxDQUFDLEVBQUUsQ0FBQyxDQUFDO29CQUM5RixDQUFDO29CQUNELElBQUksQ0FBQyxPQUFPLEdBQUcsT0FBTyxDQUFDO2dCQUMzQixDQUFDO1lBQ0wsQ0FBQztZQUNELElBQUksUUFBUSxDQUFDLGdCQUFnQixJQUFJLEtBQUssWUFBWSxPQUFPLEVBQUUsQ0FBQztnQkFDeEQsTUFBTSxVQUFVLEdBQUcsSUFBSSxHQUFHLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDO2dCQUN0QyxVQUFVLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxTQUFTLEVBQUUsUUFBUSxDQUFDLFNBQVMsQ0FBQyxDQUFDO2dCQUMzRCxLQUFLLEdBQUcsSUFBSSxPQUFPLENBQUMsVUFBVSxFQUFFLEtBQUssQ0FBQyxDQUFDO2dCQUN2QyxHQUFHLEdBQUcsVUFBVSxDQUFDLFFBQVEsRUFBRSxDQUFDO1lBQ2hDLENBQUM7WUFDRCxLQUFLLENBQUMsV0FBVyxNQUFNLEVBQUUsRUFBRSxNQUFNLEdBQUcsRUFBRSxDQUFDLENBQUM7WUFDeEMsTUFBTSxHQUFHLEdBQUcsTUFBTSxLQUFLLENBQUMsS0FBSyxFQUFFLElBQUksQ0FBQyxDQUFDO1lBQ3JDLEtBQUssQ0FBQyxZQUFZLE1BQU0sRUFBRSxFQUFFLE1BQU0sR0FBRyxJQUFJLEdBQUcsQ0FBQyxNQUFNLElBQUksR0FBRyxDQUFDLFVBQVUsRUFBRSxDQUFDLENBQUM7WUFDekUsT0FBTyxHQUFHLENBQUM7UUFDZixDQUFDO0tBQ0osQ0FBQztJQUNGLElBQUksUUFBUSxDQUFDLE9BQU8sSUFBSSxRQUFRLENBQUMsUUFBUSxFQUFFLENBQUM7UUFDeEMsTUFBTSxHQUFHLFlBQVksQ0FBQztZQUNsQixHQUFHLFlBQVk7WUFDZixJQUFJLEVBQUUsQ0FBQyxJQUFJLEVBQUUsRUFBRTtnQkFDWCxJQUFJLElBQUksQ0FBQyxNQUFNLEtBQUssT0FBTyxFQUFFLENBQUM7b0JBQzFCLE9BQU8sR0FBRyxRQUFRLENBQUMsUUFBUSxJQUFJLFFBQVEsQ0FBQyxPQUFPLEVBQUUsQ0FBQztnQkFDdEQsQ0FBQztnQkFFRCxPQUFPO1lBQ1gsQ0FBQztTQUNKLENBQUMsQ0FBQztJQUNQLENBQUM7U0FBTSxDQUFDO1FBQ0osTUFBTSxHQUFHLFlBQVksQ0FBQyxZQUFZLENBQUMsQ0FBQztJQUN4QyxDQUFDO0lBRUQsT0FBTyxFQUFFLE1BQU0sRUFBRSxZQUFZLENBQUMsTUFBTSxDQUFDLEVBQUUsT0FBTyxFQUFFLFFBQVEsRUFBRSxDQUFDO0FBQy9ELENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xpZW50LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vbGliL2NsaWVudC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssTUFBTSxZQUFZLENBQUM7QUFDL0IsT0FBTyxFQUFFLGVBQWUsRUFBRSxNQUFNLGFBQWEsQ0FBQztBQUM5QyxPQUFPLEVBQUUsWUFBWSxFQUFFLE1BQU0sOEJBQThCLENBQUM7QUFDNUQsT0FBTyxFQUFFLFlBQVksRUFBRSxNQUFNLDZCQUE2QixDQUFDO0FBQzNELE9BQU8sRUFBRSxPQUFPLEVBQUUsTUFBTSxjQUFjLENBQUM7QUFxSnZDOzs7Ozs7OztHQVFHO0FBQ0gsTUFBTSxVQUFVLGdCQUFnQixDQUFtRCxPQUFxQjtJQUNwRyxNQUFNLFFBQVEsR0FBb0I7UUFDOUIsT0FBTyxFQUFFLE9BQU8sRUFBRSxPQUFPLElBQUksSUFBSTtRQUNqQyxTQUFTLEVBQUUsT0FBTyxFQUFFLFNBQVMsSUFBSSxJQUFJO1FBQ3JDLFFBQVEsRUFBRSxPQUFPLEVBQUUsUUFBUSxJQUFJLElBQUk7UUFDbkMsT0FBTyxFQUFFLE9BQU8sRUFBRSxPQUFPLElBQUksa0JBQWtCO1FBQy9DLFNBQVMsRUFBRTtZQUNQLFVBQVUsRUFBRSxPQUFPLEVBQUUsU0FBUyxFQUFFLFVBQVUsSUFBSSxDQUFDO1lBQy9DLGFBQWEsRUFBRSxPQUFPLEVBQUUsU0FBUyxFQUFFLGFBQWEsSUFBSSxFQUFFO1lBQ3RELFdBQVcsRUFBRSxPQUFPLEVBQUUsU0FBUyxFQUFFLFdBQVc7WUFDNUMsS0FBSyxFQUFFLE9BQU8sRUFBRSxTQUFTLEVBQUUsS0FBSyxJQUFJLElBQUk7WUFDeEMsVUFBVSxFQUFFLE9BQU8sRUFBRSxTQUFTLEVBQUUsVUFBVSxJQUFJLENBQUM7U0FDbEQ7UUFDRCxjQUFjLEVBQUUsT0FBTyxFQUFFLGNBQWMsSUFBSSxFQUFFO1FBQzdDLGNBQWMsRUFBRSxPQUFPLEVBQUUsY0FBYyxJQUFJLGlDQUFpQztRQUM1RSxTQUFTLEVBQUUsT0FBTyxFQUFFLFNBQVMsSUFBSSxRQUFRLE9BQU8sdUNBQXVDLE9BQU8sRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDLE1BQU0sT0FBTyxDQUFDLFFBQVEsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEdBQUc7UUFDNUksZ0JBQWdCLEVBQUUsT0FBTyxFQUFFLGdCQUFnQixJQUFJLFFBQVEsSUFBSSxVQUFVO0tBQ3hFLENBQUM7SUFDRixpR0FBaUc7SUFDakcsTUFBTSxnQkFBZ0IsR0FBRyxLQUFLLElBQTRCLEVBQUU7UUFDeEQsSUFBSSxRQUFRLENBQUMsU0FBUyxFQUFFLENBQUM7WUFDckIsTUFBTSxLQUFLLEdBQUcsT0FBTyxRQUFRLENBQUMsU0FBUyxLQUFLLFVBQVUsQ0FBQyxDQUFDLENBQUMsTUFBTSxRQUFRLENBQUMsU0FBUyxFQUFFLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUM7WUFDekcsSUFBSSxLQUFLO2dCQUFFLE9BQU8sVUFBVSxLQUFLLEVBQUUsQ0FBQztRQUN4QyxDQUFDO1FBQ0QsSUFBSSxRQUFRLENBQUMsT0FBTyxJQUFJLFFBQVEsQ0FBQyxRQUFRO1lBQUUsT0FBTyxTQUFTLElBQUksQ0FBQyxHQUFHLFFBQVEsQ0FBQyxRQUFRLElBQUksUUFBUSxDQUFDLE9BQU8sRUFBRSxDQUFDLEVBQUUsQ0FBQztRQUM5RyxPQUFPLElBQUksQ0FBQztJQUNoQixDQUFDLENBQUM7SUFDRixNQUFNLE1BQU0sR0FBVyxZQUFZLENBQUM7UUFDaEMsT0FBTyxFQUFFLFFBQVEsQ0FBQyxPQUFPO1FBQ3pCLE9BQU8sRUFBRSxRQUFRLENBQUMsZ0JBQWdCLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUM7WUFDN0MsWUFBWSxFQUFFLFFBQVEsQ0FBQyxTQUFTO1NBQ25DO1FBQ0QsS0FBSyxFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFxQixFQUFFO1lBQzVDLElBQUksR0FBRyxHQUFHLFNBQVMsRUFBRSxNQUFNLEdBQUcsU0FBUyxDQUFDO1lBQ3hDLG1IQUFtSDtZQUNuSCxJQUFJLEtBQUssWUFBWSxPQUFPLEVBQUUsQ0FBQztnQkFDM0IsR0FBRyxHQUFHLEtBQUssQ0FBQyxHQUFHLENBQUM7Z0JBQ2hCLE1BQU0sR0FBRyxLQUFLLENBQUMsTUFBTSxDQUFDLFdBQVcsRUFBRSxDQUFDO2dCQUNwQyxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsZUFBZSxDQUFDLEVBQUUsQ0FBQztvQkFDdEMsTUFBTSxhQUFhLEdBQUcsTUFBTSxnQkFBZ0IsRUFBRSxDQUFDO29CQUMvQyxJQUFJLGFBQWE7d0JBQUUsS0FBSyxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsZUFBZSxFQUFFLGFBQWEsQ0FBQyxDQUFDO2dCQUN6RSxDQUFDO1lBQ0wsQ0FBQztpQkFBTSxJQUFJLElBQUksRUFBRSxDQUFDO2dCQUNkLEdBQUcsR0FBRyxLQUFLLENBQUMsUUFBUSxFQUFFLENBQUM7Z0JBQ3ZCLE1BQU0sR0FBRyxJQUFJLENBQUMsTUFBTSxFQUFFLFdBQVcsRUFBRSxJQUFJLEtBQUssQ0FBQztnQkFDN0MsTUFBTSxPQUFPLEdBQUcsSUFBSSxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDO2dCQUMxQyxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxlQUFlLENBQUMsRUFBRSxDQUFDO29CQUNoQyxNQUFNLGFBQWEsR0FBRyxNQUFNLGdCQUFnQixFQUFFLENBQUM7b0JBQy9DLElBQUksYUFBYTt3QkFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLGVBQWUsRUFBRSxhQUFhLENBQUMsQ0FBQztnQkFDbkUsQ0FBQztnQkFDRCxJQUFJLENBQUMsT0FBTyxHQUFHLE9BQU8sQ0FBQztZQUMzQixDQUFDO1lBQ0QsSUFBSSxRQUFRLENBQUMsZ0JBQWdCLElBQUksS0FBSyxZQUFZLE9BQU8sRUFBRSxDQUFDO2dCQUN4RCxNQUFNLFVBQVUsR0FBRyxJQUFJLEdBQUcsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUM7Z0JBQ3RDLFVBQVUsQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLFNBQVMsRUFBRSxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUM7Z0JBQzNELEtBQUssR0FBRyxJQUFJLE9BQU8sQ0FBQyxVQUFVLEVBQUUsS0FBSyxDQUFDLENBQUM7Z0JBQ3ZDLEdBQUcsR0FBRyxVQUFVLENBQUMsUUFBUSxFQUFFLENBQUM7WUFDaEMsQ0FBQztZQUNELEtBQUssQ0FBQyxXQUFXLE1BQU0sRUFBRSxFQUFFLE1BQU0sR0FBRyxFQUFFLENBQUMsQ0FBQztZQUN4QyxJQUFJLE9BQU8sR0FBRyxDQUFDLEVBQUUsR0FBYSxDQUFDO1lBQy9CLFNBQVMsQ0FBQztnQkFDTiw0RkFBNEY7Z0JBQzVGLDhEQUE4RDtnQkFDOUQsR0FBRyxHQUFHLE1BQU0sS0FBSyxDQUFDLEtBQUssWUFBWSxPQUFPLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxLQUFLLEVBQUUsQ0FBQyxDQUFDLENBQUMsS0FBSyxFQUFFLElBQUksQ0FBQyxDQUFDO2dCQUMxRSxLQUFLLENBQUMsWUFBWSxNQUFNLEVBQUUsRUFBRSxNQUFNLEdBQUcsSUFBSSxHQUFHLENBQUMsTUFBTSxJQUFJLEdBQUcsQ0FBQyxVQUFVLEVBQUUsQ0FBQyxDQUFDO2dCQUN6RSxJQUFJLEdBQUcsQ0FBQyxNQUFNLEtBQUssR0FBRztvQkFBRSxNQUFNO2dCQUM5QixNQUFNLFVBQVUsR0FBRyxlQUFlLENBQUMsR0FBRyxDQUFDLENBQUM7Z0JBQ3hDLE1BQU0sU0FBUyxHQUFHLFFBQVEsQ0FBQyxTQUFTLENBQUMsS0FBSyxJQUFJLE9BQU8sR0FBRyxRQUFRLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBQztnQkFDdEYsUUFBUSxDQUFDLFNBQVMsQ0FBQyxXQUFXLEVBQUUsQ0FBQztvQkFDN0IsT0FBTyxFQUFFLE9BQU8sR0FBRyxDQUFDO29CQUNwQixVQUFVLEVBQUUsUUFBUSxDQUFDLFNBQVMsQ0FBQyxVQUFVO29CQUN6QyxPQUFPLEVBQUUsS0FBSyxZQUFZLE9BQU8sQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxJQUFJLE9BQU8sQ0FBQyxHQUFHLEVBQUUsSUFBSSxDQUFDO29CQUNsRSxRQUFRLEVBQUUsR0FBRztvQkFDYixVQUFVO29CQUNWLFNBQVM7aUJBQ1osQ0FBQyxDQUFDO2dCQUNILElBQUksQ0FBQyxTQUFTO29CQUFFLE1BQU07Z0JBQ3RCLE1BQU0sS0FBSyxHQUFHLElBQUksQ0FBQyxHQUFHLENBQUMsVUFBVSxJQUFJLFFBQVEsQ0FBQyxTQUFTLENBQUMsVUFBVSxHQUFHLENBQUMsSUFBSSxPQUFPLEVBQUUsUUFBUSxDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUMsQ0FBQztnQkFDckgsS0FBSyxDQUFDLFlBQVksTUFBTSxFQUFFLEVBQUUsTUFBTSxHQUFHLDZCQUE2QixLQUFLLGNBQWMsT0FBTyxHQUFHLENBQUMsSUFBSSxRQUFRLENBQUMsU0FBUyxDQUFDLFVBQVUsR0FBRyxDQUFDLENBQUM7Z0JBQ3RJLDZFQUE2RTtnQkFDN0UsTUFBTSxHQUFHLENBQUMsSUFBSSxFQUFFLE1BQU0sRUFBRSxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsR0FBRSxDQUFDLENBQUMsQ0FBQztnQkFDekMsTUFBTSxJQUFJLE9BQU8sQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDLFVBQVUsQ0FBQyxPQUFPLEVBQUUsS0FBSyxHQUFHLElBQUksQ0FBQyxDQUFDLENBQUM7Z0JBQ2hFLE9BQU8sRUFBRSxDQUFDO1lBQ2QsQ0FBQztZQUNELE9BQU8sR0FBRyxDQUFDO1FBQ2YsQ0FBQztLQUNKLENBQUMsQ0FBQztJQUVILE9BQU8sRUFBRSxNQUFNLEVBQUUsWUFBWSxDQUFDLE1BQU0sQ0FBQyxFQUFFLE9BQU8sRUFBRSxRQUFRLEVBQUUsQ0FBQztBQUMvRCxDQUFDIn0=