pi-lean-dimension 0.5.0 → 0.6.0

package/node_modules/pi-lean-host/api-guides/internet-archive/multi-recipe.test.ts

@@ -12,13 +12,7 @@
  */
 
 import { describe, it, expect, vi, beforeAll, afterAll } from "vitest";
-import {
-	mkdtempSync,
-	mkdirSync,
-	writeFileSync,
-	rmSync,
-	readFileSync,
-} from "node:fs";
+import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
@@ -30,11 +24,8 @@ vi.mock("../../core/transport.js", async () => ({
 	fetchUrl: vi.fn(),
 }));
 
-import {
-	findGuidesByDomain,
-	setUserGuidesDir,
-	invalidateCache,
-} from "../../core/guide-store.js";
+import { findGuidesByDomain } from "../../core/guide-store.js";
+import { stageGuides } from "../../__tests__/test-utils.js";
 
 // Folder keys (slug(shortName)) for the two guides claiming archive.org.
 const DOMAINS = ["internet-archive", "wayback-availability"] as const;
@@ -42,20 +33,9 @@ const DOMAINS = ["internet-archive", "wayback-availability"] as const;
 let tmpBase: string;
 
 async function setupRecipe(): Promise<void> {
-	const guidesDir = mkdtempSync(join(tmpBase, "guides-"));
-	for (const d of DOMAINS) {
-		const dir = join(guidesDir, d);
-		mkdirSync(dir, { recursive: true });
-		// The test lives in api-guides/archive.org/, so the guide dirs are one
-		// level up: ../<d>/guide.md.
-		const source = readFileSync(
-			new URL(`../${d}/guide.md`, import.meta.url),
-			"utf-8",
-		);
-		writeFileSync(join(dir, "guide.md"), source, "utf-8");
-	}
-	setUserGuidesDir(guidesDir);
-	invalidateCache();
+	// The test lives in api-guides/archive.org/; the guide dirs are siblings
+	// under api-guides/ — exactly what stageGuides copies from.
+	stageGuides(tmpBase, new URL("../", import.meta.url), DOMAINS);
 }
 
 /** Resolve an op across all guides claiming the domain — mirrors api-fetch. */

package/node_modules/pi-lean-host/api-guides/stripe/has-more.test.ts

@@ -19,13 +19,7 @@ import {
 	afterAll,
 	beforeEach,
 } from "vitest";
-import {
-	mkdtempSync,
-	mkdirSync,
-	writeFileSync,
-	rmSync,
-	readFileSync,
-} from "node:fs";
+import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import type { ApiGuide } from "../../core/api-guide-types.js";
@@ -40,8 +34,7 @@ vi.mock("../../core/transport.js", async () => ({
 
 import { fetchUrl } from "../../core/transport.js";
 import { paginate } from "../../core/helpers.js";
-import { loadApiGuidesFromDir } from "../../core/guide-catalog.js";
-import { setUserGuidesDir, invalidateCache } from "../../core/guide-store.js";
+import { stageGuides } from "../../__tests__/test-utils.js";
 
 // Drain any under-consumed Once-queue so a leaky test can't shift its
 // leftover pages into the next test (mockReset also clears calls).
@@ -80,15 +73,10 @@ const PAGE3_EMPTY = page([], false);
 let tmpBase: string;
 
 async function setupRecipe(): Promise<{ guide: ApiGuide }> {
-	const guidesDir = mkdtempSync(join(tmpBase, "guides-"));
-	const domainDir = join(guidesDir, "stripe");
-	mkdirSync(domainDir, { recursive: true });
-	const source = readFileSync(new URL("./guide.md", import.meta.url), "utf-8");
-	writeFileSync(join(domainDir, "guide.md"), source, "utf-8");
-	setUserGuidesDir(guidesDir);
-	invalidateCache();
-	const loaded = loadApiGuidesFromDir(guidesDir);
-	return { guide: loaded.guides["stripe"]! };
+	const { guides } = stageGuides(tmpBase, new URL("../", import.meta.url), [
+		"stripe",
+	]);
+	return { guide: guides["stripe"]! };
 }
 
 beforeAll(() => {

package/node_modules/pi-lean-host/api-guides/telegram-bot/path-auth.test.ts

@@ -28,16 +28,10 @@ import {
 	beforeEach,
 	afterAll,
 } from "vitest";
-import {
-	mkdtempSync,
-	mkdirSync,
-	writeFileSync,
-	rmSync,
-	readFileSync,
-} from "node:fs";
+import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import type { ApiGuide, Operation } from "../../core/api-guide-types.js";
+import type { ApiGuide } from "../../core/api-guide-types.js";
 
 // Mock the transport layer BEFORE any imports that use it.
 vi.mock("../../core/transport.js", async () => ({
@@ -50,8 +44,7 @@ vi.mock("../../core/transport.js", async () => ({
 import { fetchUrl } from "../../core/transport.js";
 const fetchUrlMock = vi.mocked(fetchUrl);
 
-import { loadApiGuidesFromDir } from "../../core/guide-catalog.js";
-import { setUserGuidesDir, invalidateCache } from "../../core/guide-store.js";
+import { stageGuides, findOp } from "../../__tests__/test-utils.js";
 import { resolveOpForExecution } from "../../core/resolve-op.js";
 import { setSecretsDir, writeSecret } from "../../core/secrets-store.js";
 
@@ -65,21 +58,10 @@ let tmpBase: string;
 
 /** Stage the on-disk guide into a tmp guides dir and load it. */
 async function setupRecipe(): Promise<{ guide: ApiGuide }> {
-	const guidesDir = mkdtempSync(join(tmpBase, "guides-"));
-	const domainDir = join(guidesDir, "telegram-bot");
-	mkdirSync(domainDir, { recursive: true });
-	const source = readFileSync(new URL("./guide.md", import.meta.url), "utf-8");
-	writeFileSync(join(domainDir, "guide.md"), source, "utf-8");
-	setUserGuidesDir(guidesDir);
-	invalidateCache();
-	const loaded = loadApiGuidesFromDir(guidesDir);
-	return { guide: loaded.guides["telegram-bot"]! };
-}
-
-function findOp(guide: ApiGuide, name: string): Operation {
-	const op = guide.operations.find((o) => o.name === name);
-	if (!op) throw new Error(`op ${name} not found`);
-	return op;
+	const { guides } = stageGuides(tmpBase, new URL("../", import.meta.url), [
+		"telegram-bot",
+	]);
+	return { guide: guides["telegram-bot"]! };
 }
 
 beforeAll(() => {

package/node_modules/pi-lean-host/api-guides/twitch/oauth2.test.ts

@@ -16,20 +16,10 @@
  */
 
 import { describe, it, expect, vi, beforeAll, afterAll } from "vitest";
-import {
-	mkdtempSync,
-	mkdirSync,
-	writeFileSync,
-	rmSync,
-	readFileSync,
-} from "node:fs";
+import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import type {
-	ApiGuide,
-	OAuth2Auth,
-	Operation,
-} from "../../core/api-guide-types.js";
+import type { ApiGuide, OAuth2Auth } from "../../core/api-guide-types.js";
 
 // Mock the transport layer BEFORE any imports that use it.
 vi.mock("../../core/transport.js", async () => ({
@@ -39,52 +29,27 @@ vi.mock("../../core/transport.js", async () => ({
 	fetchUrl: vi.fn(),
 }));
 
-import { loadApiGuidesFromDir } from "../../core/guide-catalog.js";
-import { setUserGuidesDir, invalidateCache } from "../../core/guide-store.js";
 import { resolveOpForExecution } from "../../core/resolve-op.js";
 import { setSecretsDir, writeSecret } from "../../core/secrets-store.js";
 import { setOAuthDir, readToken, writeToken } from "../../core/oauth-store.js";
+import {
+	stageGuides,
+	findOp,
+	stubTokenEndpoint,
+	tokenResponse,
+} from "../../__tests__/test-utils.js";
 
 const TT = "https://id.twitch.tv/oauth2/token";
 const STORE_DOMAIN = "twitch.tv"; // canonicalStoreDomain = guide.domains[0]
 
-function stubTokenEndpoint(
-	handler: (url: string, init: RequestInit) => Response,
-): void {
-	vi.stubGlobal(
-		"fetch",
-		vi.fn((url: unknown, init?: RequestInit) =>
-			Promise.resolve(handler(String(url), init ?? {})),
-		),
-	);
-}
-
-function tokenResponse(body: unknown, status = 200): Response {
-	return new Response(JSON.stringify(body), {
-		status,
-		headers: { "content-type": "application/json" },
-	});
-}
-
 let tmpBase: string;
 
 /** Stage the on-disk twitch guide into a tmp guides dir and load it. */
 async function setupRecipe(): Promise<{ guide: ApiGuide }> {
-	const guidesDir = mkdtempSync(join(tmpBase, "guides-"));
-	const domainDir = join(guidesDir, "twitch");
-	mkdirSync(domainDir, { recursive: true });
-	const source = readFileSync(new URL("./guide.md", import.meta.url), "utf-8");
-	writeFileSync(join(domainDir, "guide.md"), source, "utf-8");
-	setUserGuidesDir(guidesDir);
-	invalidateCache();
-	const loaded = loadApiGuidesFromDir(guidesDir);
-	return { guide: loaded.guides["twitch"]! };
-}
-
-function findOp(guide: ApiGuide, name: string): Operation {
-	const op = guide.operations.find((o) => o.name === name);
-	if (!op) throw new Error(`op ${name} not found`);
-	return op;
+	const { guides } = stageGuides(tmpBase, new URL("../", import.meta.url), [
+		"twitch",
+	]);
+	return { guide: guides["twitch"]! };
 }
 
 beforeAll(() => {

package/node_modules/pi-lean-host/api-guides/twitch-user/oauth-user.test.ts

@@ -19,20 +19,10 @@
  */
 
 import { describe, it, expect, vi, beforeAll, afterAll } from "vitest";
-import {
-	mkdtempSync,
-	mkdirSync,
-	writeFileSync,
-	rmSync,
-	readFileSync,
-} from "node:fs";
+import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import type {
-	ApiGuide,
-	OAuth2Auth,
-	Operation,
-} from "../../core/api-guide-types.js";
+import type { ApiGuide, OAuth2Auth } from "../../core/api-guide-types.js";
 
 // Mock the transport layer BEFORE any imports that use it.
 vi.mock("../../core/transport.js", async () => ({
@@ -42,59 +32,28 @@ vi.mock("../../core/transport.js", async () => ({
 	fetchUrl: vi.fn(),
 }));
 
-import { loadApiGuidesFromDir } from "../../core/guide-catalog.js";
-import { setUserGuidesDir, invalidateCache } from "../../core/guide-store.js";
 import { resolveOpForExecution } from "../../core/resolve-op.js";
 import { setSecretsDir, writeSecret } from "../../core/secrets-store.js";
 import { setOAuthDir, readToken, writeToken } from "../../core/oauth-store.js";
+import {
+	stageGuides,
+	findOp,
+	stubTokenEndpoint,
+	tokenResponse,
+} from "../../__tests__/test-utils.js";
 
 const TT = "https://id.twitch.tv/oauth2/token";
 const STORE_DOMAIN = "twitch.tv"; // canonicalStoreDomain = guide.domains[0]
 
-function stubTokenEndpoint(
-	handler: (url: string, init: RequestInit) => Response,
-): void {
-	vi.stubGlobal(
-		"fetch",
-		vi.fn((url: unknown, init?: RequestInit) =>
-			Promise.resolve(handler(String(url), init ?? {})),
-		),
-	);
-}
-
-function tokenResponse(body: unknown, status = 200): Response {
-	return new Response(JSON.stringify(body), {
-		status,
-		headers: { "content-type": "application/json" },
-	});
-}
-
 let tmpBase: string;
 
 /** Stage on-disk guides into a tmp guides dir and load them. */
 async function setupRecipes(
 	dirs: string[],
 ): Promise<{ guides: Record<string, ApiGuide> }> {
-	const guidesDir = mkdtempSync(join(tmpBase, "guides-"));
-	for (const dir of dirs) {
-		const domainDir = join(guidesDir, dir);
-		mkdirSync(domainDir, { recursive: true });
-		const source = readFileSync(
-			new URL(`../${dir}/guide.md`, import.meta.url),
-			"utf-8",
-		);
-		writeFileSync(join(domainDir, "guide.md"), source, "utf-8");
-	}
-	setUserGuidesDir(guidesDir);
-	invalidateCache();
-	const loaded = loadApiGuidesFromDir(guidesDir);
-	return { guides: loaded.guides as Record<string, ApiGuide> };
-}
-
-function findOp(guide: ApiGuide, name: string): Operation {
-	const op = guide.operations.find((o) => o.name === name);
-	if (!op) throw new Error(`op ${name} not found`);
-	return op;
+	// The test lives in api-guides/twitch-user/; sibling guide dirs resolve
+	// from the api-guides/ root.
+	return stageGuides(tmpBase, new URL("../", import.meta.url), dirs);
 }
 
 function provisionCreds(): void {

package/node_modules/pi-lean-host/api-guides/usgs/transform.test.ts

@@ -6,16 +6,10 @@
  */
 
 import { describe, it, expect, vi, beforeAll, afterAll } from "vitest";
-import {
-	mkdtempSync,
-	mkdirSync,
-	writeFileSync,
-	rmSync,
-	readFileSync,
-} from "node:fs";
+import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import type { ApiGuide, Operation } from "../../core/api-guide-types.js";
+import type { ApiGuide } from "../../core/api-guide-types.js";
 
 // Mock the transport layer BEFORE any imports that use it.
 vi.mock("../../core/transport.js", async () => ({
@@ -27,8 +21,7 @@ vi.mock("../../core/transport.js", async () => ({
 
 import { restGet, paginate } from "../../core/helpers.js";
 import { loadTransform } from "../../core/local-helpers.js";
-import { loadApiGuidesFromDir } from "../../core/guide-catalog.js";
-import { setUserGuidesDir, invalidateCache } from "../../core/guide-store.js";
+import { stageGuides, findOp } from "../../__tests__/test-utils.js";
 import { transform } from "./helper.ts";
 
 // ── Fixture — a GeoJSON FeatureCollection ───────────────────────────
@@ -77,23 +70,13 @@ const FC_BODY = JSON.stringify(FC);
 let tmpBase: string;
 
 async function setupRecipe(): Promise<{ guide: ApiGuide }> {
-	const guidesDir = mkdtempSync(join(tmpBase, "guides-"));
-	const domainDir = join(guidesDir, "usgs");
-	mkdirSync(domainDir, { recursive: true });
-	for (const file of ["guide.md", "helper.ts"] as const) {
-		const source = readFileSync(new URL(`./${file}`, import.meta.url), "utf-8");
-		writeFileSync(join(domainDir, file), source, "utf-8");
-	}
-	setUserGuidesDir(guidesDir);
-	invalidateCache();
-	const loaded = loadApiGuidesFromDir(guidesDir);
-	return { guide: loaded.guides["usgs"]! };
-}
-
-function findOp(guide: ApiGuide, name: string): Operation {
-	const op = guide.operations.find((o) => o.name === name);
-	if (!op) throw new Error(`op ${name} not found`);
-	return op;
+	const { guides } = stageGuides(
+		tmpBase,
+		new URL("../", import.meta.url),
+		["usgs"],
+		["guide.md", "helper.ts"],
+	);
+	return { guide: guides["usgs"]! };
 }
 
 beforeAll(() => {

package/node_modules/pi-lean-host/api-guides/wikidata-search/numeric-cursor.test.ts

@@ -19,13 +19,7 @@ import {
 	afterAll,
 	beforeEach,
 } from "vitest";
-import {
-	mkdtempSync,
-	mkdirSync,
-	writeFileSync,
-	rmSync,
-	readFileSync,
-} from "node:fs";
+import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import type { ApiGuide } from "../../core/api-guide-types.js";
@@ -39,8 +33,7 @@ vi.mock("../../core/transport.js", async () => ({
 }));
 
 import { paginate } from "../../core/helpers.js";
-import { loadApiGuidesFromDir } from "../../core/guide-catalog.js";
-import { setUserGuidesDir, invalidateCache } from "../../core/guide-store.js";
+import { stageGuides } from "../../__tests__/test-utils.js";
 import { fetchUrl } from "../../core/transport.js";
 
 // Drain any under-consumed Once-queue so a leaky test can't shift its
@@ -100,15 +93,10 @@ const PAGE2 = JSON.stringify({
 let tmpBase: string;
 
 async function setupRecipe(): Promise<{ guide: ApiGuide }> {
-	const guidesDir = mkdtempSync(join(tmpBase, "guides-"));
-	const domainDir = join(guidesDir, "wikidata-search");
-	mkdirSync(domainDir, { recursive: true });
-	const source = readFileSync(new URL("./guide.md", import.meta.url), "utf-8");
-	writeFileSync(join(domainDir, "guide.md"), source, "utf-8");
-	setUserGuidesDir(guidesDir);
-	invalidateCache();
-	const loaded = loadApiGuidesFromDir(guidesDir);
-	return { guide: loaded.guides["wikidata-search"]! };
+	const { guides } = stageGuides(tmpBase, new URL("../", import.meta.url), [
+		"wikidata-search",
+	]);
+	return { guide: guides["wikidata-search"]! };
 }
 
 beforeAll(() => {

package/node_modules/pi-lean-host/api-guides/wikimedia-action/token-bag.test.ts

@@ -7,13 +7,7 @@
  */
 
 import { describe, it, expect, vi, beforeAll, afterAll } from "vitest";
-import {
-	mkdtempSync,
-	mkdirSync,
-	writeFileSync,
-	rmSync,
-	readFileSync,
-} from "node:fs";
+import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import type { ApiGuide } from "../../core/api-guide-types.js";
@@ -28,8 +22,7 @@ vi.mock("../../core/transport.js", async () => ({
 
 import { paginate } from "../../core/helpers.js";
 import { loadTransform } from "../../core/local-helpers.js";
-import { loadApiGuidesFromDir } from "../../core/guide-catalog.js";
-import { setUserGuidesDir, invalidateCache } from "../../core/guide-store.js";
+import { stageGuides } from "../../__tests__/test-utils.js";
 import { transform } from "./helper.ts";
 
 const PAGE1 = JSON.stringify({
@@ -55,17 +48,13 @@ const PAGE2 = JSON.stringify({
 let tmpBase: string;
 
 async function setupRecipe(): Promise<{ guide: ApiGuide }> {
-	const guidesDir = mkdtempSync(join(tmpBase, "guides-"));
-	const domainDir = join(guidesDir, "wikimedia-action");
-	mkdirSync(domainDir, { recursive: true });
-	for (const file of ["guide.md", "helper.ts"] as const) {
-		const source = readFileSync(new URL(`./${file}`, import.meta.url), "utf-8");
-		writeFileSync(join(domainDir, file), source, "utf-8");
-	}
-	setUserGuidesDir(guidesDir);
-	invalidateCache();
-	const loaded = loadApiGuidesFromDir(guidesDir);
-	return { guide: loaded.guides["wikimedia-action"]! };
+	const { guides } = stageGuides(
+		tmpBase,
+		new URL("../", import.meta.url),
+		["wikimedia-action"],
+		["guide.md", "helper.ts"],
+	);
+	return { guide: guides["wikimedia-action"]! };
 }
 
 beforeAll(() => {

package/node_modules/pi-lean-host/core/auth.ts

@@ -698,7 +698,8 @@ function applyClientAuth(
 		);
 		headers["authorization"] = "Basic " + cred;
 		return [cred, `Basic ${cred}`];
-	} else if (method === "client_secret_post") {
+	}
+	if (method === "client_secret_post") {
 		form["client_secret"] = clientSecret.secret;
 	}
 	return [];

package/node_modules/pi-lean-host/core/helpers.ts

@@ -372,13 +372,13 @@ export function resolveJsonPath(obj: unknown, path: string): unknown {
 		if (current === null || typeof current !== "object") return undefined;
 		if (Array.isArray(current)) {
 			const idx = parseInt(part, 10);
-			if (isNaN(idx)) return undefined;
+			if (Number.isNaN(idx)) return undefined;
 			// Negative index addresses from the end; out of bounds → miss.
 			const j = idx < 0 ? idx + current.length : idx;
 			if (j < 0 || j >= current.length) return undefined;
-			current = current[j];
+			current = current[j]; // nosemgrep: javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop
 		} else {
-			current = (current as Record<string, unknown>)[part];
+			current = (current as Record<string, unknown>)[part]; // nosemgrep: javascript.lang.security.audit.prototype-pollution.prototype-pollution-loop.prototype-pollution-loop
 		}
 	}
 	return current;
@@ -730,16 +730,25 @@ function buildExecutorEnv(
 	const literalHeaders =
 		guide.auth.kind === "oauth2" ? undefined : guide.auth.headers;
 	const extraHeaders = { ...literalHeaders, ...opts?.authHeaders };
+	// Shared fetch-args base: the env-owned slice of the FetchWithOptsArgs
+	// literal, assembled once so a new secret channel can't be wired into one
+	// executor and missed in the other. Callers add the situational fields
+	// (accept, fresh, guardRedirects, fallbackCharset).
+	const baseFetchArgs: Omit<FetchWithOptsArgs, "accept"> = {
+		extraHeaders,
+		secretHeaderNames: opts?.secretHeaderNames,
+		hasQuerySecret,
+		secretQueryParamNames: opts?.secretQueryParamNames,
+		hasPathSecret: hasPathSecrets,
+		redactPathSecret,
+	};
 	return {
 		fillParams,
 		queryParamsForBuild,
 		pathValues,
 		secretParamNames,
 		secretParams,
-		hasQuerySecret,
-		hasPathSecrets,
-		redactPathSecret,
-		extraHeaders,
+		baseFetchArgs,
 	};
 }
 
@@ -807,10 +816,7 @@ export async function restGet(
 		pathValues,
 		secretParamNames,
 		secretParams,
-		hasQuerySecret,
-		hasPathSecrets,
-		redactPathSecret,
-		extraHeaders,
+		baseFetchArgs,
 	} = buildExecutorEnv(guide, params, opts);
 
 	// Steps 1/2: fill path, build query (agent-supplied only — secret
@@ -847,15 +853,10 @@ export async function restGet(
 	//    APIs); an explicit header charset always wins.
 	const shape = operation.parse ?? guide.responseShape;
 	const result = await fetchWithOpts(fetchUrlRaw, {
+		...baseFetchArgs,
 		accept,
-		extraHeaders,
 		fresh: opts?.fresh,
 		fallbackCharset: shape.charset,
-		secretHeaderNames: opts?.secretHeaderNames,
-		hasQuerySecret,
-		secretQueryParamNames: opts?.secretQueryParamNames,
-		hasPathSecret: hasPathSecrets,
-		redactPathSecret,
 	});
 
 	// 7. Check HTTP status before attempting to parse the body.
@@ -973,10 +974,7 @@ export async function paginate(
 		pathValues,
 		secretParamNames,
 		secretParams,
-		hasQuerySecret,
-		hasPathSecrets,
-		redactPathSecret,
-		extraHeaders,
+		baseFetchArgs,
 	} = buildExecutorEnv(guide, params, opts);
 
 	// State for the styles.
@@ -1003,7 +1001,7 @@ export async function paginate(
 			operation.params[pagCfg.pageParam!]?.default ??
 			fallback;
 		page = typeof rawPage === "number" ? rawPage : parseInt(String(rawPage), 10);
-		if (isNaN(page)) page = fallback;
+		if (Number.isNaN(page)) page = fallback;
 	}
 
 	// Compute effective params once — used for both per-page building and result transparency.
@@ -1028,7 +1026,7 @@ export async function paginate(
 				: (params[pagCfg.pageSizeParam] ?? effectiveParams[pagCfg.pageSizeParam]);
 		effectivePageSize =
 			rawSize === undefined ? (pagCfg.pageSize ?? 50) : Number(rawSize);
-		if (isNaN(effectivePageSize)) effectivePageSize = 50;
+		if (Number.isNaN(effectivePageSize)) effectivePageSize = 50;
 	} else if (style === "cursor") {
 		// Terminal fallback for cursor is OMIT (server default applies) — no
 		// fabricated 50 like offset-limit (which needs a real number to advance
@@ -1092,8 +1090,10 @@ export async function paginate(
 
 		// Every surfaced URL (incl. a server-supplied nextUrl that may
 		// already carry the secret) is redacted at the capture point — query
-		// params by name, path tokens by value.
-		urls.push(redactSurfacedUrl(url, secretParamNames, pathValues));
+		// params by name, path tokens by value. One redaction serves the
+		// surfaced list, the status check, and the error-envelope URL below.
+		const redactedUrl = redactSurfacedUrl(url, secretParamNames, pathValues);
+		urls.push(redactedUrl);
 
 		// NextLink guard — the URL comes from the remote server, so this is
 		// the one place SSRF protection is load-bearing. `guardThisFetch`
@@ -1102,7 +1102,7 @@ export async function paginate(
 		// nextLink to an internal host; when auth headers ship, the
 		// Authorization header would attach to the redirect).
 		const guardThisFetch =
-			style === "nextLink" && !!nextUrl && !opts?.skipSsrfGuard;
+			style === "nextLink" && Boolean(nextUrl) && !opts?.skipSsrfGuard;
 		if (guardThisFetch) {
 			const guard = ssrfGuard(url);
 			if (!guard.ok) {
@@ -1122,23 +1122,17 @@ export async function paginate(
 
 		// Fetch.
 		const result = await fetchWithOpts(url, {
+			...baseFetchArgs,
 			accept,
-			extraHeaders,
 			fresh: opts?.fresh,
 			guardRedirects: guardThisFetch,
 			fallbackCharset: shape.charset,
-			secretHeaderNames: opts?.secretHeaderNames,
-			hasQuerySecret,
-			secretQueryParamNames: opts?.secretQueryParamNames,
-			hasPathSecret: hasPathSecrets,
-			redactPathSecret,
 		});
 
 		// Check HTTP status before attempting to parse. Secret values scrubbed
 		// from the error excerpt (output-channel audit). The URL stored on
 		// the error object is redacted, computed upstream of checkResponseStatus.
-		const redactedPageUrl = redactSurfacedUrl(url, secretParamNames, pathValues);
-		checkResponseStatus({ ...result, url: redactedPageUrl }, opts?.secretValues);
+		checkResponseStatus({ ...result, url: redactedUrl }, opts?.secretValues);
 
 		// Parse.
 		const data = parseResponse(result.body, shape);
@@ -1152,7 +1146,7 @@ export async function paginate(
 			checkErrorEnvelope(
 				data,
 				operation.errorPath,
-				redactedPageUrl,
+				redactedUrl,
 				opts?.secretValues,
 			);
 		}