hanzio 1.2.0 → 2.0.0

package/dist/{src/secrets/infisical.js → index-j1ybktbr.js}

@@ -1,5 +1,17 @@
-// src/secrets/infisical.ts
-import { z as z2 } from "zod";
+import {
+  createCache2
+} from "./index-k9yx6bne.js";
+import {
+  ok2,
+  err2,
+  promiseTimeout2,
+  exponentialBackoff2,
+  anySignal2
+} from "./index-0zvtcbzy.js";
+import {
+  buildQueryString2,
+  parseRetryAfter2
+} from "./index-mnkcfyx8.js";
 // src/api-wrapper/headers.ts
 var CANONICAL_HEADER_NAMES = {
   "content-type": "Content-Type",
@@ -47,7 +59,12 @@ function buildFetchBody(body, headers, configError) {
     return body;
   if (hasJsonContentType(headers))
     return JSON.stringify(body);
-  if (typeof body === "object" && (Object.getPrototypeOf(body) === Object.prototype || Object.getPrototypeOf(body) === null) && configError) {
+  const isJsonLike = Array.isArray(body) || typeof body === "object" && (Object.getPrototypeOf(body) === Object.prototype || Object.getPrototypeOf(body) === null);
+  if (isJsonLike && getHeader(headers, "content-type") === undefined) {
+    headers["Content-Type"] = "application/json";
+    return JSON.stringify(body);
+  }
+  if (isJsonLike && configError) {
     throw configError("Request body is a plain object but Content-Type is not application/json");
   }
   return body;
@@ -197,9 +214,12 @@ function tryParseJson(body) {
 // src/api-wrapper/errors.ts
 var MAX_BODY_PREVIEW = 500;
 
-class ApiError extends Error {
+class ApiError2 extends Error {
   context;
   cause;
+  get category() {
+    return "unknown";
+  }
   constructor(message, context, options) {
     super(message);
     this.name = "ApiError";
@@ -209,13 +229,14 @@ class ApiError extends Error {
   toJSON() {
     return {
       name: this.name,
+      category: this.category,
       message: this.message,
       context: this.context
     };
   }
 }
 
-class HttpResponseError extends ApiError {
+class HttpResponseError2 extends ApiError2 {
   status;
   body;
   bodyJson;
@@ -231,6 +252,9 @@ class HttpResponseError extends ApiError {
     this.requestId = getHeader(responseHeaders, "x-request-id") ?? getHeader(responseHeaders, "x-correlation-id");
     this.bodyJson = tryParseJson(body);
   }
+  get category() {
+    return this.status >= 500 ? "server_error" : "client_error";
+  }
   toJSON() {
     return {
       ...super.toJSON(),
@@ -243,25 +267,31 @@ class HttpResponseError extends ApiError {
   }
 }
 
-class ResponseValidationError extends ApiError {
+class ResponseValidationError2 extends ApiError2 {
   zodError;
   rawResponse;
   issues;
   validationIssues;
-  constructor(zodError, rawResponse, context) {
+  invalidJson;
+  constructor(zodError, rawResponse, context, options = {}) {
     const issues = formatZodIssues(zodError, rawResponse);
     const summary = renderIssueSummary(issues);
     super(`Response validation failed (${context.method} ${context.url}):
 ${summary}`, context, { cause: zodError });
     this.name = "ResponseValidationError";
+    this.invalidJson = options.invalidJson ?? false;
     this.zodError = zodError;
     this.rawResponse = rawResponse;
     this.issues = issues;
     this.validationIssues = issues.map((i) => `${i.path}: ${i.message}`).join("; ");
   }
+  get category() {
+    return "output_validation";
+  }
   toJSON() {
     return {
       ...super.toJSON(),
+      invalidJson: this.invalidJson,
       issues: this.issues,
       validationIssues: this.validationIssues,
       rawResponsePreview: previewValue(this.rawResponse, 1000)
@@ -269,7 +299,7 @@ ${summary}`, context, { cause: zodError });
   }
 }
 
-class RequestValidationError extends ApiError {
+class RequestValidationError2 extends ApiError2 {
   zodError;
   target;
   rawInput;
@@ -287,6 +317,9 @@ ${summary}`, context, { cause: zodError });
     this.issues = issues;
     this.validationIssues = issues.map((i) => `${i.path}: ${i.message}`).join("; ");
   }
+  get category() {
+    return "input_validation";
+  }
   toJSON() {
     return {
       ...super.toJSON(),
@@ -297,63 +330,92 @@ ${summary}`, context, { cause: zodError });
   }
 }
 
-class RequestTimeoutError extends ApiError {
+class RequestTimeoutError2 extends ApiError2 {
   timeoutMs;
   constructor(timeoutMs, context) {
     super(`Request timed out after ${timeoutMs}ms: ${context.method} ${context.url}`, context);
     this.name = "RequestTimeoutError";
     this.timeoutMs = timeoutMs;
   }
+  get category() {
+    return "timeout";
+  }
 }
 
-class NetworkError extends ApiError {
+class NetworkError2 extends ApiError2 {
   constructor(message, context, cause) {
     super(message, context, { cause });
     this.name = "NetworkError";
   }
+  get category() {
+    return "network";
+  }
 }
 
-class RequestAbortedError extends ApiError {
+class RequestAbortedError2 extends ApiError2 {
   constructor(context, cause) {
     super(`Request aborted: ${context.method} ${context.url}`, context, {
       cause
     });
     this.name = "RequestAbortedError";
   }
+  get category() {
+    return "aborted";
+  }
 }
 
-class ConfigError extends ApiError {
+class ConfigError2 extends ApiError2 {
   constructor(message, context) {
     super(message, context);
     this.name = "ConfigError";
   }
+  get category() {
+    return "config";
+  }
+}
+
+class ApiResponseError2 extends ApiError2 {
+  data;
+  constructor(message, data, context, cause) {
+    super(message, context, { cause });
+    this.name = "ApiResponseError";
+    this.data = data;
+  }
+  get category() {
+    return "response_rejected";
+  }
+  toJSON() {
+    return {
+      ...super.toJSON(),
+      dataPreview: previewValue(this.data, 1000)
+    };
+  }
 }
 
-class ActionError extends ApiError {
+class ActionError2 extends ApiError2 {
   constructor(message, context, cause) {
     super(message, context, { cause });
     this.name = "ActionError";
   }
+  get category() {
+    return "action";
+  }
 }
-var isApiError = (e) => e instanceof ApiError;
-var isHttpResponseError = (e) => e instanceof HttpResponseError;
-var isResponseValidationError = (e) => e instanceof ResponseValidationError;
-var isRequestValidationError = (e) => e instanceof RequestValidationError;
-var isRequestTimeoutError = (e) => e instanceof RequestTimeoutError;
-var isNetworkError = (e) => e instanceof NetworkError;
-var isRequestAbortedError = (e) => e instanceof RequestAbortedError;
-var isConfigError = (e) => e instanceof ConfigError;
-var isActionError = (e) => e instanceof ActionError;
-function isNonRetryableApiError(error) {
-  return error instanceof HttpResponseError || error instanceof ResponseValidationError || error instanceof RequestValidationError || error instanceof ConfigError || error instanceof RequestAbortedError;
+var isApiError2 = (e) => e instanceof ApiError2;
+var isHttpResponseError2 = (e) => e instanceof HttpResponseError2;
+var isResponseValidationError2 = (e) => e instanceof ResponseValidationError2;
+var isRequestValidationError2 = (e) => e instanceof RequestValidationError2;
+var isRequestTimeoutError2 = (e) => e instanceof RequestTimeoutError2;
+var isNetworkError2 = (e) => e instanceof NetworkError2;
+var isRequestAbortedError2 = (e) => e instanceof RequestAbortedError2;
+var isConfigError2 = (e) => e instanceof ConfigError2;
+var isActionError2 = (e) => e instanceof ActionError2;
+var isApiResponseError2 = (e) => e instanceof ApiResponseError2;
+function isNonRetryableApiError2(error) {
+  return error instanceof HttpResponseError2 || error instanceof ResponseValidationError2 || error instanceof ApiResponseError2 || error instanceof RequestValidationError2 || error instanceof ConfigError2 || error instanceof RequestAbortedError2;
 }
 // src/api-wrapper/builders.ts
 import { ZodError as ZodError2 } from "zod";
-function formatQueryString(queryParams, doNotEncode) {
-  if (Object.keys(queryParams).length === 0)
-    return "";
-  return doNotEncode ? Object.entries(queryParams).map(([key, value]) => `${key}=${value}`).join("&") : new URLSearchParams(queryParams).toString();
-}
 function buildUrl(options) {
   const {
     endpoint,
@@ -367,7 +429,7 @@ function buildUrl(options) {
   } = options;
   let finalUrl;
   if (url) {
-    finalUrl = replacePathParams(url, params, configError);
+    finalUrl = replaceUrlPathParams(url, params, configError);
   } else {
     const defaultBaseUrl = defaultBaseApiUrl ?? Object.keys(baseApiUrls)[0];
     if (!defaultBaseUrl) {
@@ -380,9 +442,11 @@ function buildUrl(options) {
     }
     const baseUrl = typeof configBaseUrl === "function" ? configBaseUrl() : configBaseUrl;
     const path = typeof endpoint.path === "function" ? endpoint.path(baseUrl) : endpoint.path;
-    finalUrl = `${baseUrl}${replacePathParams(path, params, configError)}`;
+    finalUrl = joinUrlPath(baseUrl, replacePathParams(path, params, configError));
   }
-  const queryString = formatQueryString(queryParams, doNotEncodeQueryParams);
+  const queryString = buildQueryString2(queryParams, {
+    encode: !doNotEncodeQueryParams
+  });
   return {
     finalUrl,
     fullUrl: queryString ? `${finalUrl}?${queryString}` : finalUrl
@@ -395,7 +459,7 @@ function buildPathParams(endpoint, params, ctx) {
     return endpoint.reqParamsSchema.parse(params);
   } catch (error) {
     if (error instanceof ZodError2) {
-      throw new RequestValidationError(error, "params", params, ctx());
+      throw new RequestValidationError2(error, "params", params, ctx());
     }
     throw error;
   }
@@ -408,15 +472,14 @@ function buildQueryParams(endpoint, query, ctx) {
       parsedQuery = endpoint.reqQuerySchema.parse(query);
     } catch (error) {
       if (error instanceof ZodError2) {
-        throw new RequestValidationError(error, "query", query, ctx());
+        throw new RequestValidationError2(error, "query", query, ctx());
       }
       throw error;
     }
   } else {
     parsedQuery = query ?? {};
   }
-  const merged = { ...defaultParams, ...parsedQuery };
-  return Object.fromEntries(Object.entries(merged).filter(([, value]) => value !== undefined).map(([key, value]) => [key, String(value)]));
+  return { ...defaultParams, ...parsedQuery };
 }
 function buildRequestBody(endpoint, body, ctx) {
   if (!endpoint.reqBodySchema)
@@ -426,7 +489,7 @@ function buildRequestBody(endpoint, body, ctx) {
     parsedBody = endpoint.reqBodySchema.parse(body);
   } catch (error) {
     if (error instanceof ZodError2) {
-      throw new RequestValidationError(error, "body", body, ctx());
+      throw new RequestValidationError2(error, "body", body, ctx());
     }
     throw error;
   }
@@ -449,7 +512,7 @@ function buildHeaders(endpoint, headers, defaultHeaders, ctx) {
       parsedHeaders = endpoint.reqHeadersSchema.parse(headers);
     } catch (error) {
       if (error instanceof ZodError2) {
-        throw new RequestValidationError(error, "headers", headers, ctx());
+        throw new RequestValidationError2(error, "headers", headers, ctx());
       }
       throw error;
     }
@@ -463,8 +526,20 @@ function buildHeaders(endpoint, headers, defaultHeaders, ctx) {
     ...parsedHeaders
   });
 }
+function joinUrlPath(base, path) {
+  if (!path || path.startsWith("?"))
+    return `${base}${path}`;
+  return `${base.replace(/\/+$/, "")}/${path.replace(/^\/+/, "")}`;
+}
+function replaceUrlPathParams(url, params, configError) {
+  const origin = url.match(/^[a-z][a-z\d+.-]*:\/\/[^/?#]*/i)?.[0] ?? "";
+  const rest = url.slice(origin.length);
+  const suffixIndex = rest.search(/[?#]/);
+  const path = suffixIndex === -1 ? rest : rest.slice(0, suffixIndex);
+  return `${origin}${replacePathParams(path, params, configError)}${rest.slice(path.length)}`;
+}
 function replacePathParams(path, params, configError) {
-  return path.replace(/:(\w+)/g, (_, key) => {
+  return path.replace(/:([A-Za-z_]\w*)/g, (_, key) => {
     const value = params?.[key];
     if (value === undefined) {
       throw configError(`Missing required path parameter: ${key}`);
@@ -475,57 +550,12 @@ function replacePathParams(path, params, configError) {
 
 // src/api-wrapper/actions-impl.ts
 function createActionCache() {
-  const store = new Map;
-  const isExpired = (entry) => entry.expiresAt !== undefined && entry.expiresAt <= Date.now();
-  const cache = async (key, fn, options) => {
-    const existing = store.get(key);
-    if (existing && !isExpired(existing)) {
-      if (existing.inflight)
-        return existing.inflight;
-      if (existing.hasValue)
-        return existing.value;
-    }
-    const promise = (async () => fn())();
-    const entry = {
-      hasValue: false,
-      inflight: promise,
-      expiresAt: options?.ttlMs !== undefined ? Date.now() + options.ttlMs : undefined
-    };
-    store.set(key, entry);
-    try {
-      const value = await promise;
-      entry.value = value;
-      entry.hasValue = true;
-      entry.inflight = undefined;
-      return value;
-    } catch (error) {
-      store.delete(key);
-      throw error;
-    }
-  };
-  cache.get = (key) => {
-    const entry = store.get(key);
-    if (!entry || !entry.hasValue)
-      return;
-    if (isExpired(entry)) {
-      store.delete(key);
-      return;
-    }
-    return entry.value;
-  };
-  cache.set = (key, value, options) => {
-    store.set(key, {
-      value,
-      hasValue: true,
-      expiresAt: options?.ttlMs !== undefined ? Date.now() + options.ttlMs : undefined
-    });
-  };
-  cache.invalidate = (key) => {
-    store.delete(key);
-  };
-  cache.clear = () => {
-    store.clear();
-  };
+  const store = createCache2();
+  const cache = (key, fn, options) => store.getOrSet(key, fn, options);
+  cache.get = (key) => store.get(key);
+  cache.set = (key, value, options) => store.set(key, value, options);
+  cache.invalidate = (key) => store.delete(key);
+  cache.clear = () => store.clear();
   return cache;
 }
 function makeDefineAction() {
@@ -539,12 +569,125 @@ function makeDefineAction() {
     const def = args[0];
     return {
       ...def,
-      noRuntimeInput: true
+      noRuntimeInput: def.input === undefined
     };
   }
   return defineAction;
 }
-var defineAction = makeDefineAction();
+var defineAction2 = makeDefineAction();
+
+// src/api-wrapper/describe.ts
+var BODY_PREVIEW = 500;
+var schemaByTarget = {
+  body: "reqBodySchema",
+  query: "reqQuerySchema",
+  params: "reqParamsSchema",
+  headers: "reqHeadersSchema",
+  input: "the action input schema"
+};
+function headline(error) {
+  if (error instanceof HttpResponseError2) {
+    const status = `HTTP ${error.status}`;
+    if (error.status >= 500) {
+      return `server error (${status}): the API failed while handling the request`;
+    }
+    if (error.status === 401 || error.status === 403) {
+      return `request rejected (${status}): check credentials and permissions`;
+    }
+    if (error.status === 404) {
+      return `request rejected (${status}): check the path and the IDs in it`;
+    }
+    if (error.status === 429)
+      return `rate limited (${status})`;
+    return `request rejected (${status}): check params, query and body`;
+  }
+  if (error instanceof RequestValidationError2) {
+    return `input validation failed: the caller's ${error.target} doesn't match ${schemaByTarget[error.target]} (nothing was sent)`;
+  }
+  if (error instanceof ResponseValidationError2) {
+    return error.invalidJson ? "output validation failed: the response body is not valid JSON" : "output validation failed: the response doesn't match resSchema";
+  }
+  if (error instanceof ApiResponseError2) {
+    return `response rejected by checkResponse: ${error.message}`;
+  }
+  if (error instanceof RequestTimeoutError2) {
+    return `timed out after ${error.timeoutMs}ms`;
+  }
+  const labels = {
+    network: `network error: couldn't reach the API (${error.message})`,
+    aborted: "aborted by the caller",
+    config: `configuration error: ${error.message}`,
+    action: `action failed: ${error.message}`
+  };
+  return labels[error.category] ?? error.message;
+}
+function details(error) {
+  if (error instanceof HttpResponseError2) {
+    const body = error.bodyJson === undefined ? error.body : previewValue(error.bodyJson, BODY_PREVIEW);
+    return body ? [
+      `  response: ${body.length > BODY_PREVIEW ? `${body.slice(0, BODY_PREVIEW)}…` : body}`
+    ] : [];
+  }
+  if (error instanceof ResponseValidationError2 || error instanceof RequestValidationError2) {
+    const lines = [renderIssueSummary(error.issues)];
+    if (error instanceof ResponseValidationError2 && !error.invalidJson) {
+      lines.push("  fix: update resSchema (or resFormatter), or mark changed fields optional");
+    }
+    return lines;
+  }
+  if (error instanceof ApiResponseError2) {
+    return [`  response: ${previewValue(error.data, BODY_PREVIEW)}`];
+  }
+  if (error instanceof ActionError2 && error.cause instanceof Error) {
+    return error.cause.stack ? [`  cause: ${error.cause.stack}`] : [];
+  }
+  return [];
+}
+function describeApiError2(error) {
+  const { context } = error;
+  const sent = error.category !== "input_validation" && error.category !== "config";
+  const meta = [
+    context.url ? `${context.method} ${context.url}` : context.method,
+    ...sent ? [`attempt ${context.attempt + 1}/${context.maxRetries + 1}`] : [],
+    `${context.elapsedMs}ms`
+  ];
+  if (error instanceof HttpResponseError2 && error.requestId) {
+    meta.push(`request id ${error.requestId}`);
+  }
+  return [
+    `✗ ${context.endpoint} failed: ${headline(error)}`,
+    `  ${meta.join(" · ")}`,
+    ...details(error)
+  ].join(`
+`);
+}
+function apiErrorLogAttributes2(error) {
+  const { context } = error;
+  const attributes = {
+    errorName: error.name,
+    category: error.category,
+    endpoint: context.endpoint,
+    method: context.method,
+    url: context.url,
+    attempt: context.attempt,
+    maxRetries: context.maxRetries,
+    elapsedMs: context.elapsedMs
+  };
+  if (error instanceof HttpResponseError2) {
+    attributes.status = error.status;
+    if (error.requestId)
+      attributes.requestId = error.requestId;
+  }
+  if (error instanceof ResponseValidationError2 || error instanceof RequestValidationError2) {
+    attributes.issueCount = error.issues.length;
+    attributes.issues = error.validationIssues;
+  }
+  if (error instanceof RequestValidationError2)
+    attributes.target = error.target;
+  if (error instanceof RequestTimeoutError2)
+    attributes.timeoutMs = error.timeoutMs;
+  return attributes;
+}
 
 // src/api-wrapper/redaction.ts
 var SENSITIVE_HEADER_KEYS = new Set([
@@ -567,6 +710,16 @@ var SENSITIVE_BODY_KEYS = new Set([
   "apikey",
   "api_key"
 ]);
+var SENSITIVE_QUERY_KEYS = new Set([
+  ...SENSITIVE_BODY_KEYS,
+  "key",
+  "code",
+  "sig",
+  "signature",
+  "x-amz-signature",
+  "x-amz-credential",
+  "x-amz-security-token"
+]);
 function redactHeaders(headers) {
   if (!headers)
     return;
@@ -595,9 +748,29 @@ function redactBody(body) {
   }
   return out;
 }
+function redactUrl(url) {
+  const queryStart = url.indexOf("?");
+  if (queryStart === -1)
+    return url;
+  const hashStart = url.indexOf("#", queryStart);
+  const query = url.slice(queryStart + 1, hashStart === -1 ? undefined : hashStart);
+  const redacted = query.split("&").map((pair) => {
+    const [key = ""] = pair.split("=", 1);
+    return SENSITIVE_QUERY_KEYS.has(decodeKey(key).toLowerCase()) ? `${key}=[REDACTED]` : pair;
+  }).join("&");
+  return `${url.slice(0, queryStart + 1)}${redacted}${hashStart === -1 ? "" : url.slice(hashStart)}`;
+}
+function decodeKey(key) {
+  try {
+    return decodeURIComponent(key.replace(/\+/g, " "));
+  } catch {
+    return key;
+  }
+}
 function defaultRedactContext(ctx) {
   return {
     ...ctx,
+    url: redactUrl(ctx.url),
     requestHeaders: redactHeaders(ctx.requestHeaders),
     requestBody: redactBody(ctx.requestBody),
     meta: ctx.meta
@@ -610,11 +783,15 @@ function applyErrorContextRedaction(ctx, config) {
   return config.redact ? config.redact(base) : base;
 }
 async function reportApiError(err, config) {
+  const rawUrl = err.context.url;
   err.context = applyErrorContextRedaction(err.context, config);
+  if (rawUrl && rawUrl !== err.context.url) {
+    err.message = err.message.split(rawUrl).join(err.context.url);
+  }
   try {
     await config.onError?.(err);
   } catch {}
-  config.logger?.error?.(err);
+  config.logger?.error?.(describeApiError2(err), apiErrorLogAttributes2(err));
   return err;
 }
 
@@ -648,7 +825,7 @@ async function validateResponse(schema, data, ctx) {
     return await schema.parseAsync(data);
   } catch (error) {
     if (error instanceof ZodError3) {
-      throw new ResponseValidationError(error, data, ctx());
+      throw new ResponseValidationError2(error, data, ctx());
     }
     throw error;
   }
@@ -656,27 +833,27 @@ async function validateResponse(schema, data, ctx) {
 async function httpRequest(config, ctx) {
   const timeoutController = new AbortController;
   const timeout = config.timeoutMs === undefined ? undefined : setTimeout(() => timeoutController.abort(), config.timeoutMs);
-  const signal = mergeSignals(timeoutController.signal, config.userSignal);
+  const signal = anySignal2(timeoutController.signal, config.userSignal);
   try {
     return await config.fetchFn(config.fullUrl, {
       method: config.method,
       headers: config.headers,
-      body: buildFetchBody(config.body, config.headers, (msg) => new ConfigError(msg, ctx())),
+      body: buildFetchBody(config.body, config.headers, (msg) => new ConfigError2(msg, ctx())),
       signal
     });
   } catch (error) {
     if (isDomAbortError(error)) {
       if (config.userSignal?.aborted) {
-        throw new RequestAbortedError(ctx(), error);
+        throw new RequestAbortedError2(ctx(), error);
       }
       if (timeoutController.signal.aborted && config.timeoutMs !== undefined) {
-        throw new RequestTimeoutError(config.timeoutMs, ctx());
+        throw new RequestTimeoutError2(config.timeoutMs, ctx());
       }
-      throw new RequestAbortedError(ctx(), error);
+      throw new RequestAbortedError2(ctx(), error);
     }
-    if (error instanceof ConfigError)
+    if (error instanceof ConfigError2)
       throw error;
-    throw new NetworkError(error instanceof Error ? error.message : String(error), ctx(), error);
+    throw new NetworkError2(error instanceof Error ? error.message : String(error), ctx(), error);
   } finally {
     if (timeout)
       clearTimeout(timeout);
@@ -685,24 +862,6 @@ async function httpRequest(config, ctx) {
 function isDomAbortError(error) {
   return typeof error === "object" && error !== null && "name" in error && error.name === "AbortError";
 }
-function mergeSignals(a, b) {
-  if (!b)
-    return a;
-  const anyFn = AbortSignal.any;
-  if (typeof anyFn === "function")
-    return anyFn([a, b]);
-  const controller = new AbortController;
-  const onAbort = () => controller.abort();
-  if (a.aborted)
-    controller.abort();
-  else
-    a.addEventListener("abort", onAbort, { once: true });
-  if (b.aborted)
-    controller.abort();
-  else
-    b.addEventListener("abort", onAbort, { once: true });
-  return controller.signal;
-}
 async function readErrorResponse(response) {
   const body = await response.text();
   return {
@@ -715,23 +874,15 @@ function getRetryDelay(params) {
   const maxDelay = params.maxRetryDelayMs ?? 30000;
   const { retryDelay, attempt, response } = params;
   if (response && (response.status === 429 || response.status === 503)) {
-    const retryAfter = response.headers.get("retry-after");
-    if (retryAfter) {
-      const seconds = Number(retryAfter);
-      if (Number.isFinite(seconds)) {
-        return Math.min(Math.max(0, seconds * 1000), maxDelay);
-      }
-      const dateMs = Date.parse(retryAfter);
-      if (!Number.isNaN(dateMs)) {
-        return Math.min(Math.max(0, dateMs - Date.now()), maxDelay);
-      }
-    }
+    const retryAfterMs = parseRetryAfter2(response.headers.get("retry-after"));
+    if (retryAfterMs !== undefined)
+      return Math.min(retryAfterMs, maxDelay);
   }
   const delayMs = typeof retryDelay === "function" ? retryDelay(attempt) : retryDelay;
   return Math.min(delayMs, maxDelay);
 }
 function shouldAttemptRetryOnError(error) {
-  return !isNonRetryableApiError(error);
+  return !isNonRetryableApiError2(error);
 }
 function shouldAttemptRetryOnHttp(retryCtx) {
   const { error, response } = retryCtx;
@@ -760,7 +911,12 @@ async function makeRequestWithRetry(args) {
   while (true) {
     let response;
     try {
-      logger?.debug?.("API request", config);
+      logger?.debug?.("API request", {
+        endpoint: endpointName,
+        method,
+        url: redactUrl(fullUrl),
+        attempt: retryCount
+      });
       response = await httpRequest(config, (over) => ctx({ attempt: retryCount, ...over }));
       await onResponse?.({
         endpoint: endpointName,
@@ -791,12 +947,12 @@ async function makeRequestWithRetry(args) {
             delayMs,
             nextAttempt: retryCount + 1
           });
+          await sleepBeforeRetry(delayMs, config.userSignal, () => ctx({ attempt: retryCount }));
           retryCount++;
-          await delay(delayMs);
           continue;
         }
         const { body, headers: responseHeaders } = await readErrorResponse(response);
-        throw new HttpResponseError(response.status, body, responseHeaders, ctx({ attempt: retryCount }));
+        throw new HttpResponseError2(response.status, body, responseHeaders, ctx({ attempt: retryCount }));
       }
       return {
         validatedData: await validateFn(response, retryCount),
@@ -804,7 +960,7 @@ async function makeRequestWithRetry(args) {
         httpStatus: response.status
       };
     } catch (error) {
-      if (isNonRetryableApiError(error)) {
+      if (isNonRetryableApiError2(error) && !(error instanceof ApiResponseError2)) {
         throw error;
       }
       const retryCtx = {
@@ -829,8 +985,8 @@ async function makeRequestWithRetry(args) {
         delayMs,
         nextAttempt: retryCount + 1
       });
+      await sleepBeforeRetry(delayMs, config.userSignal, () => ctx({ attempt: retryCount }));
       retryCount++;
-      await delay(delayMs);
     }
   }
 }
@@ -843,7 +999,7 @@ async function validateAndTransformResponse(endpoint, response, ctx) {
     try {
       responseData = text === "" ? undefined : JSON.parse(text);
     } catch (error) {
-      throw new ResponseValidationError(makeJsonParseZodError(error, text), text, ctx());
+      throw new ResponseValidationError2(makeJsonParseZodError(error, text), text, ctx(), { invalidJson: true });
     }
   } else {
     responseData = text;
@@ -852,13 +1008,17 @@ async function validateAndTransformResponse(endpoint, response, ctx) {
   const data = await validateResponse(endpoint.resSchema, transformedData, ctx);
   return { data, responseSizeBytes };
 }
-function defaultShouldRetry(ctx) {
+function defaultShouldRetry2(ctx) {
   if (ctx.error)
     return shouldAttemptRetryOnError(ctx.error);
   return shouldAttemptRetryOnHttp(ctx);
 }
-function delay(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+async function sleepBeforeRetry(ms, signal, ctx) {
+  try {
+    await promiseTimeout2(ms, { signal });
+  } catch (error) {
+    throw new RequestAbortedError2(ctx(), error);
+  }
 }
 
 // src/api-wrapper/create-client.ts
@@ -882,7 +1042,7 @@ function resolveActionInvocation(action, actionName, first, second) {
   if (isActionInvokeOptionsOnly(first)) {
     return { input: undefined, options: first };
   }
-  throw new ConfigError(`Action "${actionName}" does not accept input; pass only optional { signal, meta }`, {
+  throw new ConfigError2(`Action "${actionName}" does not accept input; pass only optional { signal, meta }`, {
     endpoint: actionName,
     method: "GET",
     url: "",
@@ -916,9 +1076,11 @@ function createApiClientImpl(apiConfig) {
       ...over
     });
     if (!endpoint) {
-      throw await reportApiError(new ConfigError(`Unknown API endpoint: ${String(endpointKey)}`, ctx()), apiConfig);
+      throw await reportApiError(new ConfigError2(`Unknown API endpoint: ${String(endpointKey)}`, ctx()), apiConfig);
     }
     baseContext.method = endpoint.method;
+    if (typeof endpoint.path === "string")
+      baseContext.url = endpoint.path;
     let pathParams;
     let queryParams;
     let body;
@@ -927,9 +1089,10 @@ function createApiClientImpl(apiConfig) {
       pathParams = buildPathParams(endpoint, rawInput.reqParams, ctx);
       queryParams = buildQueryParams(endpoint, rawInput.reqQuery, ctx);
       body = buildRequestBody(endpoint, rawInput.reqBody, ctx);
-      headers = buildHeaders(endpoint, rawInput.reqHeaders, apiConfig.defaultHeaders ?? {}, ctx);
+      const defaultHeaders = typeof apiConfig.defaultHeaders === "function" ? await apiConfig.defaultHeaders() : apiConfig.defaultHeaders;
+      headers = buildHeaders(endpoint, rawInput.reqHeaders, defaultHeaders ?? {}, ctx);
     } catch (e) {
-      if (e instanceof ApiError)
+      if (e instanceof ApiError2)
         throw await reportApiError(e, apiConfig);
       throw e;
     }
@@ -943,19 +1106,19 @@ function createApiClientImpl(apiConfig) {
         defaultBaseApiUrl: apiConfig.defaultBaseApiUrl,
         url: input.url,
         doNotEncodeQueryParams: endpoint.doNotEncodeQueryParams,
-        configError: (msg) => new ConfigError(msg, ctx())
+        configError: (msg) => new ConfigError2(msg, ctx())
       });
       fullUrl = built.fullUrl;
     } catch (e) {
-      if (e instanceof ApiError)
+      if (e instanceof ApiError2)
         throw await reportApiError(e, apiConfig);
       throw e;
     }
     baseContext.url = fullUrl;
     baseContext.requestHeaders = headers;
     baseContext.requestBody = body;
-    if (apiConfig.onRequest) {
-      try {
+    const execute = async () => {
+      if (apiConfig.onRequest) {
         const result = await apiConfig.onRequest({
           endpoint: endpointName,
           method: endpoint.method,
@@ -968,29 +1131,30 @@ function createApiClientImpl(apiConfig) {
           headers = result.headers;
         if (result && "body" in result)
           body = result.body;
-      } catch (e) {
-        if (e instanceof ApiError)
-          throw await reportApiError(e, apiConfig);
-        throw e;
       }
-    }
-    const config = {
-      method: endpoint.method,
-      fullUrl,
-      body,
-      headers,
-      timeoutMs: input.timeoutMs ?? apiConfig.timeoutMs,
-      fetchFn: input.fetch ?? apiConfig.fetch ?? fetch,
-      userSignal: input.signal
-    };
-    try {
+      const config = {
+        method: endpoint.method,
+        fullUrl,
+        body,
+        headers,
+        timeoutMs: input.timeoutMs ?? apiConfig.timeoutMs,
+        fetchFn: input.fetch ?? apiConfig.fetch ?? fetch,
+        userSignal: input.signal
+      };
       const result = await makeRequestWithRetry({
         config,
         maxRetries,
-        retryDelay: apiConfig.retryDelayMs ?? 300,
+        retryDelay: apiConfig.retryDelayMs ?? ((attempt) => exponentialBackoff2(attempt + 1, {
+          baseMs: 300,
+          maxMs: apiConfig.maxRetryDelayMs
+        })),
         maxRetryDelayMs: apiConfig.maxRetryDelayMs,
-        validateFn: (response, attempt) => validateAndTransformResponse(endpoint, response, (over) => ctx({ attempt, ...over })),
-        shouldRetry: apiConfig.shouldRetry ?? defaultShouldRetry,
+        validateFn: async (response, attempt) => {
+          const validated = await validateAndTransformResponse(endpoint, response, (over) => ctx({ attempt, ...over }));
+          await runCheckResponse(validated.data, response.status, attempt);
+          return validated;
+        },
+        shouldRetry: apiConfig.shouldRetry ?? defaultShouldRetry2,
         logger: apiConfig.logger,
         ctx,
         endpointName,
@@ -1000,22 +1164,61 @@ function createApiClientImpl(apiConfig) {
         onResponse: apiConfig.onResponse,
         onRetry: apiConfig.onRetry
       });
-      const responseTimeMs = elapsed();
-      const responseSizeMb = result.validatedData.responseSizeBytes / (1024 * 1024);
-      const requestBodySizeMb = calculateSizeInMb(config.body);
       return {
         data: result.validatedData.data,
-        requestBodySizeMb,
-        responseSizeMb,
-        responseTimeMs,
+        requestBodySizeMb: calculateSizeInMb(config.body),
+        responseSizeMb: result.validatedData.responseSizeBytes / (1024 * 1024),
+        responseTimeMs: elapsed(),
         httpStatus: result.httpStatus,
         retryCount: result.retryCount
       };
-    } catch (error) {
-      if (error instanceof ApiError)
-        throw await reportApiError(error, apiConfig);
-      throw error;
-    }
+    };
+    const runCheckResponse = async (data, httpStatus, attempt) => {
+      if (!apiConfig.checkResponse)
+        return;
+      try {
+        await apiConfig.checkResponse(data, {
+          endpoint: endpointName,
+          method: endpoint.method,
+          url: fullUrl,
+          httpStatus,
+          attempt,
+          meta: input.meta
+        });
+      } catch (error) {
+        if (error instanceof ApiError2)
+          throw error;
+        throw new ApiResponseError2(error instanceof Error ? error.message : String(error), data, ctx({ attempt }), error);
+      }
+    };
+    const run = async () => {
+      try {
+        return await execute();
+      } catch (error) {
+        if (error instanceof ApiError2) {
+          throw await reportApiError(error, apiConfig);
+        }
+        throw error;
+      }
+    };
+    const middleware = apiConfig.use ?? [];
+    if (middleware.length === 0)
+      return run();
+    const middlewareContext = {
+      client: apiConfig.name,
+      endpoint: String(endpointKey),
+      method: endpoint.method,
+      url: fullUrl,
+      headers,
+      meta: input.meta
+    };
+    const dispatch = (index) => {
+      const current = middleware[index];
+      if (!current)
+        return run();
+      return current(middlewareContext, () => dispatch(index + 1));
+    };
+    return dispatch(0);
   };
   async function invokeAction(name, rawInput, options = {}) {
     const action = actions[name];
@@ -1038,9 +1241,17 @@ function createApiClientImpl(apiConfig) {
       ...over
     });
     apiConfig.logger?.debug?.("Action start", { action: actionName });
+    let parsedInput = inputForHandler;
+    if (action.input) {
+      const parsed = await action.input.safeParseAsync(rawInput);
+      if (!parsed.success) {
+        throw await reportApiError(new RequestValidationError2(parsed.error, "input", rawInput, ctx()), apiConfig);
+      }
+      parsedInput = parsed.data;
+    }
     try {
       const result = await action.handler({
-        input: inputForHandler,
+        input: parsedInput,
         api: proxy,
         signal: options.signal,
         meta: options.meta,
@@ -1053,10 +1264,10 @@ function createApiClientImpl(apiConfig) {
       });
       return result;
     } catch (error) {
-      if (error instanceof ApiError) {
+      if (error instanceof ApiError2) {
         throw await reportApiError(error, apiConfig);
       }
-      const wrapped = new ActionError(`Action ${actionName} failed: ${error instanceof Error ? error.message : String(error)}`, ctx(), error);
+      const wrapped = new ActionError2(`Action ${actionName} failed: ${error instanceof Error ? error.message : String(error)}`, ctx(), error);
       throw await reportApiError(wrapped, apiConfig);
     }
   }
@@ -1071,7 +1282,26 @@ function createApiClientImpl(apiConfig) {
     }
     return invokeEndpoint(key, input ?? {});
   };
-  const client = { request, cache };
+  const safe = new Proxy({}, {
+    get(_target, prop) {
+      if (typeof prop !== "string")
+        return;
+      if (!(prop in apiConfig.endpoints) && !(prop in actions)) {
+        return;
+      }
+      return async (...args) => {
+        try {
+          const method = Reflect.get(proxy, prop);
+          return ok2(await method(...args));
+        } catch (error) {
+          if (error instanceof ApiError2)
+            return err2(error);
+          throw error;
+        }
+      };
+    }
+  });
+  const client = { request, cache, safe };
   const proxy = new Proxy(client, {
     get(target, prop, receiver) {
       if (prop in target || typeof prop !== "string") {
@@ -1095,9 +1325,23 @@ function createApiClientImpl(apiConfig) {
   } else if (rawActions) {
     actions = rawActions;
   }
+  const reserved = [
+    ...Object.keys(apiConfig.endpoints),
+    ...Object.keys(actions)
+  ].filter((key) => (key in client));
+  if (reserved.length > 0) {
+    throw new ConfigError2(`Endpoint/action name(s) are reserved by the client: ${reserved.join(", ")}`, {
+      endpoint: reserved[0],
+      method: "GET",
+      url: "",
+      attempt: 0,
+      maxRetries: 0,
+      elapsedMs: 0
+    });
+  }
   const collisions = Object.keys(actions).filter((key) => (key in apiConfig.endpoints));
   if (collisions.length > 0) {
-    throw new ConfigError(`Action name(s) collide with endpoint name(s): ${collisions.join(", ")}`, {
+    throw new ConfigError2(`Action name(s) collide with endpoint name(s): ${collisions.join(", ")}`, {
       endpoint: collisions[0],
       method: "GET",
       url: "",
@@ -1108,370 +1352,88 @@ function createApiClientImpl(apiConfig) {
   }
   return proxy;
 }
-var createApiClient = (apiConfig) => createApiClientImpl(apiConfig);
-// src/secrets/errors.ts
-class SecretLoadError extends Error {
-  code;
-  operation;
-  status;
-  constructor(code, message, details = {}) {
-    super(message);
-    this.name = "SecretLoadError";
-    this.code = code;
-    this.operation = details.operation;
-    this.status = details.status;
-  }
+var createApiClient2 = (apiConfig) => createApiClientImpl(apiConfig);
+// src/api-wrapper/paginate.ts
+async function* paginate2(fetchPage, getNext, options = {}) {
+  const { maxPages = Number.POSITIVE_INFINITY, signal } = options;
+  let cursor;
+  for (let count = 0;count < maxPages; count++) {
+    signal?.throwIfAborted();
+    const page = await fetchPage(cursor);
+    yield page;
+    const next = getNext(page);
+    if (next == null)
+      return;
+    cursor = next;
+  }
+}
+// src/api-wrapper/otel.ts
+var SPAN_KIND_CLIENT = 2;
+var SPAN_STATUS_ERROR = 2;
+function otelMiddleware2(tracer, options = {}) {
+  const { spanName, attributes, includeQuery = true, inject } = options;
+  return (context, next) => {
+    const url = includeQuery ? redactUrl(context.url) : context.url.split(/[?#]/, 1)[0];
+    const name = spanName?.(context) ?? (context.client ? `${context.client}.${context.endpoint}` : context.endpoint);
+    return tracer.startActiveSpan(name, {
+      kind: SPAN_KIND_CLIENT,
+      attributes: {
+        "http.request.method": context.method,
+        "url.full": url,
+        "server.address": hostOf(context.url),
+        "api.client": context.client,
+        "api.endpoint": context.endpoint,
+        ...attributes?.(context)
+      }
+    }, async (span) => {
+      inject?.(context.headers);
+      try {
+        const result = await next();
+        span.setAttributes({
+          "http.response.status_code": result.httpStatus,
+          "http.request.resend_count": result.retryCount || undefined,
+          "http.response.body.size": Math.round(result.responseSizeMb * 1024 * 1024)
+        });
+        return result;
+      } catch (error) {
+        recordFailure(span, error);
+        throw error;
+      } finally {
+        span.end();
+      }
+    });
+  };
 }
-
-// src/secrets/deadline.ts
-async function withSecretDeadline(options, operation) {
-  const timeoutMs = options.timeoutMs ?? 30000;
-  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0 || timeoutMs > 2147483647) {
-    throw new SecretLoadError("CONFIGURATION", "Secret timeoutMs must be a positive finite timer duration.");
-  }
-  const controller = new AbortController;
-  const cancel = () => controller.abort(new SecretLoadError("ABORTED", "Secret loading was cancelled."));
-  if (options.signal?.aborted) {
-    cancel();
+function recordFailure(span, error) {
+  if (error instanceof ApiError2) {
+    const isHttp = error instanceof HttpResponseError2;
+    span.setAttributes({
+      "error.type": isHttp ? String(error.status) : error.name,
+      "api.error.category": error.category,
+      "http.response.status_code": isHttp ? error.status : undefined,
+      "http.request.resend_count": error.context.attempt || undefined
+    });
   } else {
-    options.signal?.addEventListener("abort", cancel, { once: true });
-  }
-  const timer = setTimeout(() => controller.abort(new SecretLoadError("TIMEOUT", `Secret loading timed out after ${timeoutMs}ms.`)), timeoutMs);
-  let rejectOnAbort = () => {};
-  try {
-    const aborted = new Promise((_, reject) => {
-      rejectOnAbort = () => reject(controller.signal.reason);
-      controller.signal.addEventListener("abort", rejectOnAbort, { once: true });
+    span.setAttributes({
+      "error.type": error instanceof Error ? error.name : "unknown"
     });
-    if (controller.signal.aborted) {
-      throw controller.signal.reason;
-    }
-    return await Promise.race([operation(controller.signal), aborted]);
-  } finally {
-    clearTimeout(timer);
-    options.signal?.removeEventListener("abort", cancel);
-    controller.signal.removeEventListener("abort", rejectOnAbort);
   }
-}
-
-// src/secrets/environment.ts
-function getProcessEnvironment() {
-  return typeof process === "undefined" ? undefined : process.env;
-}
-function resolveSecretEnvironment(option, env) {
-  const explicit = typeof option === "function" ? option() : option;
-  if (typeof explicit === "object" && explicit !== null) {
-    if (typeof explicit.slug !== "string" || !/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(explicit.slug)) {
-      throw new SecretLoadError("CONFIGURATION", "Custom secret environment requires a valid slug.");
-    }
-    return explicit.slug;
-  }
-  const selected = explicit ?? env?.SECRETS_ENV;
-  if (selected !== undefined) {
-    if (selected === "production" || selected === "prod") {
-      return "prod";
-    }
-    if (selected === "development" || selected === "dev") {
-      return "dev";
-    }
-    if (selected === "staging") {
-      return "staging";
-    }
-    throw new SecretLoadError("CONFIGURATION", "Invalid secret environment. Use dev, staging, prod, or an explicit { slug } option.");
-  }
-  if (env?.NODE_ENV === "production" || env?.NODE_ENV === "prod") {
-    return "prod";
-  }
-  if (env?.NODE_ENV === "staging") {
-    return "staging";
-  }
-  return "dev";
-}
-
-// src/secrets/infisical-cli.ts
-async function readInfisicalCliToken(options) {
-  const { execFile } = await import("node:child_process").catch(() => {
-    throw new SecretLoadError("CLI", "Infisical CLI fallback requires a runtime with subprocess support. Provide Infisical client credentials or a custom secret loader.");
+  span.recordException(error instanceof Error ? error : String(error));
+  span.setStatus({
+    code: SPAN_STATUS_ERROR,
+    message: error instanceof Error ? error.message.split(`
+`, 1)[0] : String(error)
   });
-  options.signal.throwIfAborted();
-  const env = {
-    ...getProcessEnvironment(),
-    INFISICAL_DISABLE_UPDATE_CHECK: "true"
-  };
-  delete env.INFISICAL_TOKEN;
-  delete env.INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN;
-  delete env.TOKEN;
-  try {
-    const stdout = await new Promise((resolve, reject) => {
-      const child = execFile("infisical", [
-        "user",
-        "get",
-        "token",
-        "--plain",
-        `--domain=${options.siteUrl}`,
-        "--silent"
-      ], {
-        env,
-        encoding: "utf8",
-        shell: false,
-        timeout: options.timeoutMs ?? 30000,
-        signal: options.signal,
-        killSignal: "SIGKILL",
-        maxBuffer: 10485760,
-        windowsHide: true
-      }, (error, output) => {
-        if (error) {
-          reject(error);
-        } else {
-          resolve(output);
-        }
-      });
-      child.stdin?.end();
-    });
-    return stdout.trim();
-  } catch (error) {
-    if (options.signal.aborted) {
-      throw options.signal.reason;
-    }
-    const failure = error;
-    if (failure?.code === "ENOENT") {
-      throw new SecretLoadError("CLI", "Infisical CLI not found. Install infisical and ensure it is on PATH, or provide Infisical client credentials.");
-    }
-    if (failure?.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER") {
-      throw new SecretLoadError("CLI", "Infisical CLI output exceeded the 10 MiB limit.");
-    }
-    if (failure?.killed) {
-      throw new SecretLoadError("TIMEOUT", `Infisical CLI timed out after ${(options.timeoutMs ?? 30000) / 1000} seconds or was terminated.`);
-    }
-    throw new SecretLoadError("CLI", `Infisical CLI session token failed. Run infisical login --domain=${options.siteUrl} and verify access to the configured organization, project, and environment.`);
-  }
-}
-
-// src/secrets/infisical-config.ts
-function validateInfisicalScope(options) {
-  validateInfisicalOrganizationId(options.organizationId);
-  let url;
-  try {
-    url = new URL(options.siteUrl);
-  } catch {
-    throw new SecretLoadError("CONFIGURATION", "Invalid Infisical siteUrl.");
-  }
-  if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.search || url.hash) {
-    throw new SecretLoadError("CONFIGURATION", "Infisical siteUrl must be an HTTP(S) URL without credentials, query, or fragment.");
-  }
-  if (!options.projectId.trim() || !options.environment.trim() || !(options.secretPath ?? "/").startsWith("/")) {
-    throw new SecretLoadError("CONFIGURATION", "Infisical requires a projectId, environment, and absolute secretPath.");
-  }
 }
-function validateInfisicalOrganizationId(organizationId) {
-  if (typeof organizationId !== "string" || !organizationId.trim() || /\s/.test(organizationId)) {
-    throw new SecretLoadError("CONFIGURATION", "Infisical organizationId is required and must be a nonempty ID without whitespace.");
-  }
-}
-
-// src/secrets/infisical-session.ts
-import { z } from "zod";
-var sessionClaimsSchema = z.object({
-  organizationId: z.string().optional(),
-  subOrganizationId: z.string().optional(),
-  exp: z.number().finite().optional()
-});
-function parseInfisicalSessionToken(token) {
-  let claims;
+function hostOf(url) {
   try {
-    if (!/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(token)) {
-      throw new Error("Invalid token format");
-    }
-    const payload = token.split(".")[1];
-    const json = atob(payload.replace(/-/g, "+").replace(/_/g, "/"));
-    claims = sessionClaimsSchema.parse(JSON.parse(json));
+    return new URL(url).hostname;
   } catch {
-    throw new SecretLoadError("AUTHENTICATION", "Infisical returned an invalid user session token. Run infisical login for the configured domain.");
-  }
-  if (claims.exp !== undefined && claims.exp <= Date.now() / 1000) {
-    throw new SecretLoadError("AUTHENTICATION", "Infisical user session has expired. Run infisical login for the configured domain.");
-  }
-  return { organizationId: claims.subOrganizationId ?? claims.organizationId };
-}
-
-// src/secrets/infisical.ts
-var DEFAULT_INFISICAL_SITE_URL = "https://eu.infisical.com";
-var defaultFetch = globalThis.fetch;
-var infisicalAuthResponseSchema = z2.object({ accessToken: z2.string() });
-var infisicalSecretSchema = z2.object({
-  secretKey: z2.string(),
-  secretValue: z2.string()
-});
-var infisicalSecretsResponseSchema = z2.object({
-  secrets: z2.array(infisicalSecretSchema)
-});
-async function fetchInfisicalSecrets(options) {
-  validateInfisicalScope(options);
-  return withSecretDeadline(options, async (signal) => {
-    let operation = "login";
-    try {
-      const infisical = createInfisicalApiClient(options.siteUrl);
-      const { data: auth } = await infisical.request("login", {
-        signal,
-        reqBody: {
-          clientId: options.clientId,
-          clientSecret: options.clientSecret
-        }
-      });
-      signal.throwIfAborted();
-      operation = "listSecrets";
-      return await listInfisicalSecrets(infisical, auth.accessToken, {
-        ...options,
-        signal
-      });
-    } catch (error) {
-      throwInfisicalHttpError(error, operation, signal);
-    }
-  });
-}
-async function loadInfisicalSecrets(options) {
-  validateInfisicalScope(options);
-  const env = getProcessEnvironment();
-  const clientId = env?.[options.clientIdEnvKey];
-  const clientSecret = env?.[options.clientSecretEnvKey];
-  const mode = options.auth ?? "auto";
-  if (!["auto", "http", "cli"].includes(mode)) {
-    throw new SecretLoadError("CONFIGURATION", "Invalid Infisical auth mode.");
-  }
-  const useHttp = mode === "http" || mode === "auto" && Boolean(clientId && clientSecret);
-  if (useHttp) {
-    if (!clientId || !clientSecret) {
-      throw new SecretLoadError("AUTHENTICATION", "Infisical HTTP authentication requires both client credentials.");
-    }
-    options.reportSource?.("Infisical HTTP");
-    return fetchInfisicalSecrets({ ...options, clientId, clientSecret });
-  }
-  options.reportSource?.(`Infisical CLI session (organization=${options.organizationId} project=${options.projectId} environment=${options.environment})`);
-  return withSecretDeadline(options, (signal) => fetchInfisicalSessionSecrets({ ...options, signal }));
-}
-async function fetchInfisicalSessionSecrets(options) {
-  const { signal } = options;
-  let token = await readInfisicalCliToken(options);
-  signal.throwIfAborted();
-  const session = parseInfisicalSessionToken(token);
-  const infisical = createInfisicalApiClient(options.siteUrl);
-  let operation = "selectOrganization";
-  try {
-    if (session.organizationId !== options.organizationId) {
-      const { data } = await infisical.request("selectOrganization", {
-        signal,
-        reqHeaders: {
-          Authorization: `Bearer ${token}`,
-          "User-Agent": "hanzio/secrets"
-        },
-        reqBody: { organizationId: options.organizationId }
-      });
-      signal.throwIfAborted();
-      if (data.isMfaEnabled) {
-        throw new SecretLoadError("AUTHENTICATION", "Infisical requires MFA for this organization. Complete infisical login for the target organization and configured domain before loading secrets.", { operation });
-      }
-      const scopedSession = parseInfisicalSessionToken(data.token);
-      if (scopedSession.organizationId !== options.organizationId) {
-        throw new SecretLoadError("AUTHENTICATION", "Infisical returned a session for a different organization.", { operation });
-      }
-      token = data.token;
-    }
-    signal.throwIfAborted();
-    operation = "listSecrets";
-    return await listInfisicalSecrets(infisical, token, options);
-  } catch (error) {
-    throwInfisicalHttpError(error, operation, signal);
-  }
-}
-async function listInfisicalSecrets(infisical, token, options) {
-  const { data } = await infisical.request("listSecrets", {
-    signal: options.signal,
-    reqHeaders: { Authorization: `Bearer ${token}` },
-    reqQuery: {
-      environment: options.environment,
-      projectId: options.projectId,
-      secretPath: options.secretPath ?? "/",
-      viewSecretValue: true,
-      expandSecretReferences: true,
-      includeImports: true
-    }
-  });
-  const wantedKeys = new Set(options.keys);
-  return Object.fromEntries(data.secrets.filter((secret) => wantedKeys.has(secret.secretKey)).map((secret) => [secret.secretKey, secret.secretValue]));
-}
-function throwInfisicalHttpError(error, operation, signal) {
-  if (signal.aborted) {
-    throw signal.reason;
-  }
-  if (error instanceof SecretLoadError) {
-    throw error;
+    return;
   }
-  const status = error instanceof HttpResponseError ? error.status : undefined;
-  const guidance = operation === "selectOrganization" && (status === 401 || status === 403) ? " Run infisical login for the target organization and configured domain, then verify your access." : "";
-  throw new SecretLoadError("HTTP", `Infisical HTTP ${operation} failed${status ? ` (status ${status})` : ""}.${guidance}`, { operation, status });
-}
-function createInfisicalApiClient(siteUrl) {
-  return createApiClient({
-    name: "infisical",
-    baseApiUrls: {
-      infisical: siteUrl
-    },
-    defaultBaseApiUrl: "infisical",
-    fetch: getFetch(),
-    retries: 1,
-    endpoints: {
-      selectOrganization: {
-        method: "POST",
-        path: "/api/v3/auth/select-organization",
-        reqHeadersSchema: z2.object({
-          Authorization: z2.string(),
-          "User-Agent": z2.string()
-        }),
-        reqBodySchema: z2.object({ organizationId: z2.string() }),
-        resSchema: z2.object({
-          token: z2.string().min(1),
-          isMfaEnabled: z2.boolean().optional()
-        }),
-        reqBodyFormat: "json"
-      },
-      login: {
-        method: "POST",
-        path: "/api/v1/auth/universal-auth/login",
-        reqBodySchema: z2.object({
-          clientId: z2.string(),
-          clientSecret: z2.string()
-        }),
-        resSchema: infisicalAuthResponseSchema,
-        reqBodyFormat: "json"
-      },
-      listSecrets: {
-        method: "GET",
-        path: "/api/v4/secrets",
-        reqHeadersSchema: z2.object({
-          Authorization: z2.string()
-        }),
-        reqQuerySchema: z2.object({
-          projectId: z2.string(),
-          environment: z2.string(),
-          secretPath: z2.string(),
-          viewSecretValue: z2.boolean(),
-          expandSecretReferences: z2.boolean(),
-          includeImports: z2.boolean()
-        }),
-        resSchema: infisicalSecretsResponseSchema
-      }
-    }
-  });
 }
-function getFetch() {
-  const fetchFn = globalThis.fetch ?? defaultFetch;
-  return (input, init) => {
-    init?.signal?.throwIfAborted();
-    return fetchFn(input, init);
-  };
+// src/api-wrapper/endpoint.ts
+function defineEndpoint2(endpoint) {
+  return endpoint;
 }
-export {
-  DEFAULT_INFISICAL_SITE_URL,
-  fetchInfisicalSecrets,
-  loadInfisicalSecrets
-};
+export { ApiError2, HttpResponseError2, ResponseValidationError2, RequestValidationError2, RequestTimeoutError2, NetworkError2, RequestAbortedError2, ConfigError2, ApiResponseError2, ActionError2, isApiError2, isHttpResponseError2, isResponseValidationError2, isRequestValidationError2, isRequestTimeoutError2, isNetworkError2, isRequestAbortedError2, isConfigError2, isActionError2, isApiResponseError2, isNonRetryableApiError2, defineAction2, describeApiError2, apiErrorLogAttributes2, defaultShouldRetry2, createApiClient2, paginate2, otelMiddleware2, defineEndpoint2 };