mandala-computer-mcp 0.4.0 → 0.6.0

package/dist/api.js

@@ -1,8 +1,48 @@
 import { Agent, Headers as UndiciHeaders, fetch as undiciFetch } from 'undici';
-import { CancelledError, ConnectivityError, ConnectivityInterruptedError, errorForStatus, MandalaError, RangeNotSatisfiableError, RedirectError, } from './errors.js';
+import { CancelledError, ConnectivityError, ConnectivityInterruptedError, createOnlyRefusal, errorForStatus, isCreateOnlyUpload, MandalaError, platformSaid, RangeNotSatisfiableError, RedirectError, } from './errors.js';
+import * as P from './paths.js';
+import { MalformedSecretAnswerError, sanitizeSecretError, secretRouteOf, } from './secret-errors.js';
+import { DOCUMENTED_REASONS, secretListOf, secretOf } from './secret-store.js';
+export { isSecretStoreRoute } from './secret-errors.js';
 export const DEFAULT_BASE_URL = 'https://app.mandala.computer/api/v1';
 /** Anthropic's own key, forwarded for the one route that runs a model. */
 export const MODEL_KEY_HEADER = 'X-Model-Key';
+/**
+ * Proof, to the platform, that a request comes through the hosted MCP service
+ * (OPL-4982). The platform takes an OAuth access token only alongside it, so a
+ * token cannot be replayed at the API directly by the app it was issued to.
+ *
+ * Only this server's own value is ever sent. A header of this name arriving
+ * from anywhere else — a caller, or a per-call header set — is dropped in
+ * `#fetch`, so a client cannot supply the secret or learn anything by trying.
+ */
+export const SERVICE_HEADER = 'X-Mandala-MCP-Service';
+/**
+ * All that is kept of a secret-store refusal's body: its `reason`, if it is a
+ * word. Nothing else, and never a sentence.
+ */
+function secretStoreRefusalBody(text) {
+    if (!text)
+        return undefined;
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+        return undefined;
+    const reason = parsed.reason;
+    return typeof reason === 'string' && DOCUMENTED_REASONS.has(reason) ? { reason } : undefined;
+}
+function responseMetadata(resp) {
+    return {
+        requestId: resp.headers.get('x-request-id') ?? undefined,
+        allow: resp.headers.get('allow') ?? undefined,
+        wwwAuthenticate: resp.headers.get('www-authenticate') ?? undefined,
+    };
+}
 /**
  * How much of an event stream will be held while waiting for a boundary.
  *
@@ -28,6 +68,10 @@ const MAX_SSE_BUFFER = 8 * 1024 * 1024;
  */
 const MAX_JSON_BODY_BYTES = 48 * 1024 * 1024;
 const MAX_ERROR_BODY_BYTES = 1024 * 1024;
+/** Whether a `WWW-Authenticate` value challenges for a Bearer credential. */
+function bearerChallenged(value) {
+    return value !== null && /^\s*bearer(?:\s|,|$)/i.test(value);
+}
 /**
  * The longest foreground guest exec waits 600 seconds before it answers.
  * Node's bundled fetch gives response headers 300 seconds by default, so the
@@ -84,18 +128,6 @@ const NATIVE_FETCH = globalThis.fetch;
 export const platformFetch = () => globalThis.fetch === NATIVE_FETCH
     ? undiciFetch
     : globalThis.fetch;
-/**
- * The transport for one API key.
- *
- * One per MCP session rather than one per process, because the HTTP transport
- * authenticates each caller with their own `com_…` key and two sessions must
- * never share a client. See `src/session.ts`.
- *
- * The key lives in this object's closure and is never put on an error, a log
- * line, or a tool result. That is not paranoia about our own code: an MCP tool
- * result goes into a model's context and from there into transcripts, and an
- * API key is every computer on the account, forever.
- */
 export class Api {
     baseUrl;
     /** The same thing parsed, so a path is joined onto the path and nothing else. */
@@ -104,7 +136,8 @@ export class Api {
     #headers;
     /** Applied to every request that does not carry one of its own. See `with`. */
     #signal;
-    constructor(apiKey, baseUrl = DEFAULT_BASE_URL, signal) {
+    #options;
+    constructor(apiKey, baseUrl = DEFAULT_BASE_URL, signal, options = {}) {
         if (!apiKey) {
             throw new MandalaError('No API key. Set MANDALA_API_KEY (create one at Settings → API keys), ' +
                 'or send it as a bearer token when running over HTTP.');
@@ -145,6 +178,7 @@ export class Api {
         this.baseUrl = baseUrl.replace(/\/+$/, '');
         this.#apiKey = apiKey;
         this.#signal = signal;
+        this.#options = options;
         this.#headers = {
             Authorization: `Bearer ${apiKey}`,
             Accept: 'application/json',
@@ -165,7 +199,7 @@ export class Api {
     with(signal) {
         if (!signal || signal === this.#signal)
             return this;
-        return new Api(this.#apiKey, this.baseUrl, signal);
+        return new Api(this.#apiKey, this.baseUrl, signal, this.#options);
     }
     #url(path, query) {
         const url = new URL(this.#base);
@@ -189,8 +223,72 @@ export class Api {
         }
         return url.toString();
     }
-    async #fetch(method, path, opts = {}) {
-        const headers = { ...this.#headers, ...opts.headers };
+    /**
+     * The secret-store route a path lands on, judged on the URL it is actually
+     * sent to — after the same joining and dot-segment normalization dispatch
+     * uses, and percent-decoded — so `//secrets`, `./secrets` and
+     * `x/../secrets` are the store too. A path whose URL cannot be built is
+     * treated as the store: an error from it is sanitized, which costs nothing.
+     */
+    #secretRoute(path) {
+        try {
+            const pathname = new URL(this.#url(path)).pathname;
+            const base = this.#base.pathname.replace(/\/+$/, '');
+            const decode = (p) => p
+                .split('/')
+                .map((seg) => {
+                try {
+                    return decodeURIComponent(seg);
+                }
+                catch {
+                    return seg;
+                }
+            })
+                .join('/');
+            if (pathname === base || pathname.startsWith(`${base}/`))
+                return secretRouteOf(decode(pathname.slice(base.length)));
+            // Above the API root: judge by the last segments, which is where the
+            // store's own two routes would be.
+            const parts = decode(pathname).toLowerCase().split('/').filter(Boolean);
+            if (parts.at(-1) === 'secrets')
+                return 'secrets';
+            if (parts.includes('secrets'))
+                return 'secrets/:id';
+            return undefined;
+        }
+        catch {
+            return 'secrets/:id';
+        }
+    }
+    /**
+     * The one boundary for the secret store. Every public operation runs inside
+     * it, so ANY exception a request to `secrets` or `secrets/:id` raises — a
+     * refusal, a redirect, a malformed or empty answer, a body read, a header
+     * check, a network failure, an argument that throws when it is read — leaves
+     * as the rebuilt error {@link sanitizeSecretError} makes. The request's value
+     * is read inside the sanitizer's own guard, never here.
+     */
+    async #guard(method, path, opts, fn) {
+        const route = this.#secretRoute(path);
+        if (route === undefined)
+            return fn();
+        try {
+            return await fn();
+        }
+        catch (err) {
+            throw sanitizeSecretError(err, method, route, () => opts?.body);
+        }
+    }
+    async #fetch(method, path, opts = {}, bounded = false) {
+        const headers = { ...this.#headers };
+        for (const [name, value] of Object.entries(opts.headers ?? {})) {
+            // Case-insensitively: a record keyed `x-mandala-mcp-service` beside the
+            // canonical spelling would be sent as both, joined into one value.
+            if (name.toLowerCase() !== SERVICE_HEADER.toLowerCase())
+                headers[name] = value;
+        }
+        if (this.#options.serviceSecret)
+            headers[SERVICE_HEADER] = this.#options.serviceSecret;
         // Typed as what we actually build rather than as BodyInit, which @types/node
         // does not put in the global scope.
         let body;
@@ -207,6 +305,8 @@ export class Api {
             body = JSON.stringify(opts.body);
         }
         const signal = opts.signal ?? this.#signal;
+        if (bounded && signal?.aborted)
+            throw cancellationError(method, path, 'before dispatch');
         const requested = this.#url(path, opts.query);
         const fetchRequest = platformFetch();
         let resp;
@@ -227,7 +327,11 @@ export class Api {
                 redirect: 'manual',
                 dispatcher: PLATFORM_DISPATCHER,
             };
-            resp = await fetchRequest(requested, init);
+            resp = bounded
+                ? await boundedWait(fetchRequest(requested, init), signal, (value) => {
+                    void value.body?.cancel().catch(() => { });
+                })
+                : await fetchRequest(requested, init);
         }
         catch (cause) {
             // Cancellation first, because it is not a connectivity failure and the
@@ -287,14 +391,26 @@ export class Api {
             // one holds its undici connection open until the GC gets to it — and the
             // whole point of this branch is a misconfigured base URL, which means
             // EVERY request takes it.
-            await resp.body?.cancel().catch(() => { });
+            if (bounded)
+                void resp.body?.cancel().catch(() => { });
+            else
+                await resp.body?.cancel().catch(() => { });
             throw new RedirectError(`${method} /${path.replace(/^\/+/, '')} was redirected (HTTP ${resp.status}${to ? ` to ${to}` : ', with no Location header'}). This client does not follow redirects. Verify that MANDALA_BASE_URL names the API ` +
                 `root that serves this request; ${to
                     ? 'the resource URL in Location is not itself a base URL to copy'
-                    : 'the configured API root did not identify the resource directly'}. Retrying this unchanged gets the same answer.`, resp.status);
+                    : 'the configured API root did not identify the resource directly'}. Retrying this unchanged gets the same answer.`, resp.status, undefined, undefined, responseMetadata(resp));
+        }
+        if (!resp.ok) {
+            // Reported before the body is read, so a transport holding its answer
+            // for this can refuse the HTTP request while the tool is still unwinding.
+            if (resp.status === 401 && bearerChallenged(resp.headers.get('www-authenticate'))) {
+                this.#options.onBearerRefused?.();
+            }
+            const err = await this.#error(resp, method, path, signal, bounded);
+            // A create-only upload's 409 with no usable reason is final, decided here
+            // rather than in the tool so an embedder's isTransient agrees (OPL-4994).
+            throw isCreateOnlyUpload(method, path, opts.query) ? createOnlyRefusal(err) : err;
         }
-        if (!resp.ok)
-            throw await this.#error(resp, method, path, signal);
         return resp;
     }
     /**
@@ -305,13 +421,18 @@ export class Api {
      * that predates window actions" — and replacing them with a status line would
      * throw away the only part of the response a model can do anything with.
      */
-    async #error(resp, method, path, signal) {
+    async #error(resp, method, path, signal, bounded = false) {
         let body;
         let message = `HTTP ${resp.status}`;
         let text = '';
         let truncated = false;
         try {
-            ({ text, truncated } = await readBody(method, path, signal, () => readTextAtMost(resp, MAX_ERROR_BODY_BYTES)));
+            ({ text, truncated } = await readBody(method, path, signal, () => bounded
+                ? readComplete(resp, 8192, signal).then((bytes) => ({
+                    text: new TextDecoder().decode(bytes),
+                    truncated: false,
+                }))
+                : readTextAtMost(resp, MAX_ERROR_BODY_BYTES)));
         }
         catch (cause) {
             // A response whose error body itself is broken still has a useful status.
@@ -320,7 +441,16 @@ export class Api {
             if (cause instanceof CancelledError)
                 throw cause;
         }
-        if (text) {
+        if (text && this.#secretRoute(path) !== undefined) {
+            // The secret store takes a value in its request, so its answers are the
+            // one place a platform echoing input would echo a secret. No response
+            // text is kept for them at all — not as the message, not as the body:
+            // only the one-word `reason`, when it is a word, and the status. A
+            // truncated copy of the text cannot be redacted reliably, so none is
+            // made (OPL-5026).
+            body = secretStoreRefusalBody(truncated ? undefined : text);
+        }
+        else if (text) {
             try {
                 // A prefix is not JSON even when it happens to end at a syntactically
                 // valid boundary. Only trust a structured platform message after the
@@ -328,11 +458,7 @@ export class Api {
                 if (truncated)
                     throw new SyntaxError('truncated response body');
                 body = JSON.parse(text);
-                const err = body?.error;
-                if (typeof err === 'string' && err)
-                    message = err;
-                else
-                    message = text.slice(0, 500);
+                message = platformSaid(body) ?? text.slice(0, 500);
             }
             catch {
                 message = text.slice(0, 500);
@@ -349,12 +475,19 @@ export class Api {
             }
         }
         const delay = retryAfterMs(resp.headers.get('retry-after'));
+        const metadata = responseMetadata(resp);
         // Content-Range describes the file length, independently of Retry-After.
         if (resp.status === 416) {
             const total = parseContentRange(resp.headers.get('content-range'))?.total;
-            return new RangeNotSatisfiableError(message, resp.status, body, total, delay);
+            return new RangeNotSatisfiableError(message, resp.status, body, total, delay, {
+                ...metadata,
+                method,
+            });
         }
-        return errorForStatus(resp.status, message, body, delay);
+        return errorForStatus(resp.status, message, body, delay, {
+            ...metadata,
+            method,
+        });
     }
     /**
      * A JSON body, or nothing, or a named failure.
@@ -379,7 +512,10 @@ export class Api {
             return JSON.parse(text);
         }
         catch {
-            throw new MandalaError(`expected JSON from ${method} ${path}, got: ${text.slice(0, 200)}`);
+            // Never the text for the secret store: see #error.
+            throw new MandalaError(this.#secretRoute(path) !== undefined
+                ? `expected JSON from ${method} ${path}, got a body that is not JSON (not shown)`
+                : `expected JSON from ${method} ${path}, got: ${text.slice(0, 200)}`);
         }
     }
     /**
@@ -396,6 +532,9 @@ export class Api {
      * Routes where an empty body IS the answer use `send`.
      */
     async json(method, path, opts = {}) {
+        return this.#guard(method, path, opts, () => this.#jsonRaw(method, path, opts));
+    }
+    async #jsonRaw(method, path, opts = {}) {
         const resp = await this.#fetch(method, path, opts);
         const body = await this.#decode(resp, method, path, opts.signal ?? this.#signal);
         if (body === undefined || body === null) {
@@ -403,6 +542,75 @@ export class Api {
         }
         return body;
     }
+    /** Existing exec decoding plus observed status, used only to confirm optional retention. */
+    async jsonWithStatus(method, path, opts = {}) {
+        return this.#guard(method, path, opts, () => this.#jsonWithStatusRaw(method, path, opts));
+    }
+    async #jsonWithStatusRaw(method, path, opts = {}) {
+        const resp = await this.#fetch(method, path, opts);
+        const value = await this.#decode(resp, method, path, opts.signal ?? this.#signal);
+        if (value === undefined || value === null)
+            throw new MandalaError('Expected an exec response');
+        return { status: resp.status, value };
+    }
+    /** Complete bounded responses for immutable retained protocols; never a successful prefix. */
+    async boundedBytes(method, path, limit, status, opts = {}) {
+        return this.#guard(method, path, opts, () => this.#boundedBytesRaw(method, path, limit, status, opts));
+    }
+    async #boundedBytesRaw(method, path, limit, status, opts = {}) {
+        if (!Number.isSafeInteger(limit) || limit < 0 || limit > 64 * 1024 * 1024)
+            throw new MandalaError('Invalid bounded response limit');
+        const signal = opts.signal ?? this.#signal;
+        const resp = await this.#fetch(method, path, { ...opts, headers: { ...opts.headers, 'Accept-Encoding': 'identity' } }, true);
+        try {
+            if (resp.status !== status ||
+                resp.headers.has('Content-Range') ||
+                !['', 'identity'].includes(resp.headers.get('Content-Encoding') ?? ''))
+                throw new MandalaError('Unexpected retained response protocol');
+            const length = resp.headers.get('Content-Length');
+            if (length !== null &&
+                (!/^(0|[1-9][0-9]*)$/.test(length) ||
+                    String(Number(length)) !== length ||
+                    !Number.isSafeInteger(Number(length)) ||
+                    Number(length) > limit))
+                throw new MandalaError('Invalid retained response length');
+            const bytes = await readBody(method, path, signal, () => readComplete(resp, limit, signal));
+            if (length !== null && Number(length) !== bytes.length)
+                throw new MandalaError('Incomplete retained response');
+            if (signal?.aborted)
+                throw cancellationError(method, path, 'after reading the platform response');
+            const headers = {};
+            for (const name of [
+                'content-type',
+                'content-length',
+                'x-result-offset',
+                'x-result-next-offset',
+                'x-result-eof',
+            ]) {
+                const value = resp.headers.get(name);
+                if (value !== null)
+                    headers[name] = value;
+            }
+            return { bytes, headers };
+        }
+        finally {
+            void resp.body?.cancel().catch(() => { });
+        }
+    }
+    async boundedJson(method, path, limit, status, opts = {}) {
+        return this.#guard(method, path, opts, () => this.#boundedJsonRaw(method, path, limit, status, opts));
+    }
+    async #boundedJsonRaw(method, path, limit, status, opts = {}) {
+        const response = await this.boundedBytes(method, path, limit, status, opts);
+        if (!/^application\/json(?:\s*;|$)/i.test(response.headers['content-type'] ?? ''))
+            throw new MandalaError('Expected retained JSON metadata');
+        try {
+            return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(response.bytes));
+        }
+        catch {
+            throw new MandalaError('Invalid retained JSON metadata');
+        }
+    }
     /**
      * A request whose answer may legitimately be nothing.
      *
@@ -411,6 +619,9 @@ export class Api {
      * possibly-absent so a caller has to decide what to say when it is.
      */
     async send(method, path, opts = {}) {
+        return this.#guard(method, path, opts, () => this.#sendRaw(method, path, opts));
+    }
+    async #sendRaw(method, path, opts = {}) {
         const resp = await this.#fetch(method, path, opts);
         return this.#decode(resp, method, path, opts.signal ?? this.#signal);
     }
@@ -430,6 +641,9 @@ export class Api {
      * count that means nothing at zero.
      */
     async listing(path, opts = {}) {
+        return this.#guard('GET', path, opts, () => this.#listingRaw(path, opts));
+    }
+    async #listingRaw(path, opts = {}) {
         const resp = await this.#fetch('GET', path, opts);
         const short = resp.headers.get('X-GC-Incomplete');
         return {
@@ -442,6 +656,9 @@ export class Api {
     }
     /** For the two routes whose body is not JSON: the screenshot and the download. */
     async bytes(method, path, opts = {}, maxBytes) {
+        return this.#guard(method, path, opts, () => this.#bytesRaw(method, path, opts, maxBytes));
+    }
+    async #bytesRaw(method, path, opts = {}, maxBytes) {
         const resp = await this.#fetch(method, path, opts);
         const contentType = mediaType(resp.headers.get('content-type'));
         const limit = typeof maxBytes === 'function' ? maxBytes(contentType) : maxBytes;
@@ -506,6 +723,77 @@ export class Api {
             window,
         };
     }
+    // --- the account's secret store (OPL-4984) ------------------------------
+    /**
+     * The account's secret store, `GET|POST secrets` and `GET|PUT|DELETE
+     * secrets/:id`, as five typed calls.
+     *
+     * Typed, and decoded strictly, because a value goes IN here and the caller
+     * must be able to rely on nothing coming back: every answer is reduced to the
+     * documented fields before it is returned, so no answer can hand a value on.
+     * A malformed answer is a {@link MandalaError}; for a change it says the
+     * change may have been made. Bound to this client, so
+     * `api.with(signal).secrets` carries the signal.
+     */
+    get secrets() {
+        // Each call runs wholly inside the boundary: its arguments are read, the
+        // request made and the answer decoded within one try, and anything thrown
+        // is rebuilt by the sanitizer — which reads the value under its own guard.
+        const guard = (method, route, value, fn) => (async () => {
+            try {
+                return await fn();
+            }
+            catch (err) {
+                throw sanitizeSecretError(err, method, route, value);
+            }
+        })();
+        const malformed = () => new MalformedSecretAnswerError('malformed');
+        return {
+            list: (opts) => guard('GET', 'secrets', () => undefined, async () => {
+                const list = secretListOf(await this.json('GET', P.SECRETS, {
+                    query: P.secretScopeQuery(opts?.workspaceId),
+                }));
+                if (!list)
+                    throw malformed();
+                return list;
+            }),
+            create: (args) => guard('POST', 'secrets', () => args.value, async () => {
+                const body = {
+                    name: args.name,
+                    value: args.value,
+                    ...(args.workspaceId === undefined ? {} : { workspace_id: args.workspaceId }),
+                };
+                const secret = secretOf(await this.json('POST', P.SECRETS, { body }));
+                if (!secret)
+                    throw malformed();
+                return secret;
+            }),
+            get: (id, opts) => guard('GET', 'secrets/:id', () => undefined, async () => {
+                const secret = secretOf(await this.json('GET', P.secret(id), {
+                    query: P.secretScopeQuery(opts?.workspaceId),
+                }));
+                if (!secret)
+                    throw malformed();
+                return secret;
+            }),
+            replace: (id, args) => guard('PUT', 'secrets/:id', () => args.value, async () => {
+                const body = {
+                    value: args.value,
+                    revision_id: args.revisionId,
+                    ...(args.workspaceId === undefined ? {} : { workspace_id: args.workspaceId }),
+                };
+                const secret = secretOf(await this.json('PUT', P.secret(id), { body }));
+                if (!secret)
+                    throw malformed();
+                return secret;
+            }),
+            delete: (id, args) => guard('DELETE', 'secrets/:id', () => undefined, async () => {
+                await this.send('DELETE', P.secret(id), {
+                    query: { revision_id: args.revisionId, ...P.secretScopeQuery(args.workspaceId) },
+                });
+            }),
+        };
+    }
     /**
      * The agent route, which answers with a stream of steps rather than a result.
      *
@@ -514,6 +802,21 @@ export class Api {
      * it is over is one the person watching cannot tell from a hang.
      */
     async *sse(method, path, opts = {}) {
+        // The iterator runs inside the boundary too: an error while reading the
+        // stream is raised from here, not from the request.
+        const route = this.#secretRoute(path);
+        if (route === undefined) {
+            yield* this.#sseRaw(method, path, opts);
+            return;
+        }
+        try {
+            yield* this.#sseRaw(method, path, opts);
+        }
+        catch (err) {
+            throw sanitizeSecretError(err, method, route, () => opts.body);
+        }
+    }
+    async *#sseRaw(method, path, opts = {}) {
         const resp = await this.#fetch(method, path, {
             ...opts,
             headers: { ...opts.headers, Accept: 'text/event-stream' },
@@ -1208,4 +1511,72 @@ export function filenameFrom(disposition) {
             return p.value;
     return undefined;
 }
+/** An abort releases the caller even if a peer ignores cancellation. Late headers are cancelled. */
+function boundedWait(work, signal, late) {
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const abort = () => {
+            if (settled)
+                return;
+            settled = true;
+            signal?.removeEventListener('abort', abort);
+            reject(new CancelledError('Retained operation cancelled; commitment may be unknown.'));
+        };
+        signal?.addEventListener('abort', abort, { once: true });
+        if (signal?.aborted)
+            abort();
+        work.then((value) => {
+            if (settled) {
+                late?.(value);
+                return;
+            }
+            settled = true;
+            signal?.removeEventListener('abort', abort);
+            resolve(value);
+        }, (error) => {
+            if (settled)
+                return;
+            settled = true;
+            signal?.removeEventListener('abort', abort);
+            reject(error);
+        });
+    });
+}
+async function readComplete(resp, limit, signal) {
+    if (signal?.aborted)
+        throw new CancelledError('Retained operation cancelled');
+    if (!resp.body)
+        return new Uint8Array();
+    const reader = resp.body.getReader(), chunks = [];
+    let size = 0;
+    const cancel = () => {
+        void reader.cancel().catch(() => { });
+    };
+    signal?.addEventListener('abort', cancel, { once: true });
+    try {
+        for (;;) {
+            const next = await boundedWait(reader.read(), signal);
+            if (signal?.aborted)
+                throw new CancelledError('Retained operation cancelled');
+            if (next.done)
+                break;
+            if (next.value.byteLength > limit - size)
+                throw new MandalaError('Retained response exceeds limit');
+            chunks.push(next.value.slice());
+            size += next.value.byteLength;
+        }
+        const bytes = new Uint8Array(size);
+        let at = 0;
+        for (const chunk of chunks) {
+            bytes.set(chunk, at);
+            at += chunk.length;
+        }
+        return bytes;
+    }
+    finally {
+        signal?.removeEventListener('abort', cancel);
+        cancel();
+        reader.releaseLock();
+    }
+}
 //# sourceMappingURL=api.js.map