runline 0.33.0 → 0.35.0

package/dist/plugins/_shared/googleCredentials.js

@@ -1,5 +1,12 @@
-import { AuthError, OAuthGrantSchema, } from "runline";
-import * as t from "typebox";
+import { AuthError, } from "runline";
+import { grantSchema } from "./credentials.js";
+/** The grant every Google plugin's consent belongs to. */
+export const GOOGLE_GRANT = "google";
+/**
+ * Google's fixed token endpoint: a JSON credential's token_uri never
+ * selects egress.
+ */
+export const GOOGLE_TOKEN_URL = "https://oauth2.googleapis.com/token";
 /** Only legacy storage infers a method; host bindings always select it explicitly. */
 export function googleMethod(cfg) {
     if (cfg.authMethod !== undefined) {
@@ -51,6 +58,19 @@ const API_BASES = {
     calendar: "https://www.googleapis.com/calendar/v3/",
     gmail: "https://gmail.googleapis.com/gmail/v1/users/me/",
 };
+/** The Cloud Console service each API base belongs to, to enable it by. */
+const API_SERVICES = {
+    drive: "drive.googleapis.com",
+    upload: "drive.googleapis.com",
+    docs: "docs.googleapis.com",
+    sheets: "sheets.googleapis.com",
+    slides: "slides.googleapis.com",
+    script: "script.googleapis.com",
+    tasks: "tasks.googleapis.com",
+    people: "people.googleapis.com",
+    calendar: "calendar-json.googleapis.com",
+    gmail: "gmail.googleapis.com",
+};
 const PLUGIN_TARGETS = {
     googleDrive: ["drive", "upload", "docs"],
     googleDocs: ["docs", "drive"],
@@ -62,11 +82,19 @@ const PLUGIN_TARGETS = {
     googleCalendar: ["calendar"],
     gmail: ["gmail"],
 };
-/** Builtin routing policy, never derived from action input or a returned URL. */
-export function googleResources(plugin) {
+/** The API bases a builtin Google plugin calls; any other name is refused. */
+function targetNames(plugin) {
     if (!Object.hasOwn(PLUGIN_TARGETS, plugin))
         throw new AuthError("request_not_allowed");
-    const names = PLUGIN_TARGETS[plugin];
+    return PLUGIN_TARGETS[plugin];
+}
+/** The Cloud Console services a plugin calls, each to be enabled once. */
+export function googleServices(plugin) {
+    return [...new Set(targetNames(plugin).map((name) => API_SERVICES[name]))];
+}
+/** Builtin routing policy, never derived from action input or a returned URL. */
+export function googleResources(plugin) {
+    const names = targetNames(plugin);
     const targets = Object.fromEntries(names.map((name) => [
         name,
         {
@@ -112,24 +140,47 @@ export function googleResources(plugin) {
             : {}),
     };
 }
-/** Fixed vendor endpoints; a JSON credential's token_uri can never select egress. */
+/**
+ * A Google plugin's credential declaration: its own targets and the scopes
+ * it signs service-account requests for, the method its config selects,
+ * and — for a service account — the JWT identity, subject included.
+ */
+export function googleCredential(plugin, scopes) {
+    return (config) => {
+        const cfg = config;
+        const method = googleMethod(cfg);
+        return {
+            type: googleCredentialType(scopes, plugin),
+            method,
+            application: {
+                clientId: cfg.clientId,
+                clientSecret: cfg.clientSecret,
+            },
+            ...(method === "serviceAccount"
+                ? { jwtIdentity: googleIdentity(cfg) }
+                : {}),
+        };
+    };
+}
 export function googleCredentialType(scopes, plugin) {
-    const url = "https://oauth2.googleapis.com/token";
-    const schema = t.Object({ grant: t.Optional(OAuthGrantSchema) }, { additionalProperties: false });
     const { targets, probe } = googleResources(plugin);
     return {
         id: "google.oauth",
         methods: {
             delegated: {
-                schema,
+                schema: grantSchema,
                 authentication: {
                     kind: "oauth2",
-                    grantField: "grant",
+                    field: "grant",
                     renewal: "refresh",
+                    grant: GOOGLE_GRANT,
                     definition: {
                         id: "google.oauth",
                         provider: "google",
-                        refresh: { url, clientAuthentication: "client_secret_post" },
+                        refresh: {
+                            url: GOOGLE_TOKEN_URL,
+                            clientAuthentication: "client_secret_post",
+                        },
                     },
                 },
                 targets,
@@ -138,16 +189,19 @@ export function googleCredentialType(scopes, plugin) {
             ...(scopes.length
                 ? {
                     serviceAccount: {
-                        schema,
+                        schema: grantSchema,
                         authentication: {
                             kind: "oauth2",
-                            grantField: "grant",
+                            field: "grant",
                             renewal: "jwtBearer",
                             scopes,
                             definition: {
                                 id: "google.serviceAccount",
                                 provider: "google",
-                                jwtBearer: { url, clientAuthentication: "none" },
+                                jwtBearer: {
+                                    url: GOOGLE_TOKEN_URL,
+                                    clientAuthentication: "none",
+                                },
                             },
                         },
                         targets,

package/dist/plugins/_shared/localFile.js

@@ -0,0 +1,40 @@
+import { constants } from "node:fs";
+import { open } from "node:fs/promises";
+/**
+ * A file on the runline host that an action input names — an attachment,
+ * an upload, an image to edit — read as one bounded buffer. It must be a
+ * regular file: the nonblocking open lets fstat refuse a FIFO or device
+ * without waiting on a writer. The size is checked before allocation and
+ * the bytes are read through the same handle, so a file swapped or grown
+ * between the check and the read cannot slip past the bound.
+ */
+export async function readLocalFile(path, options) {
+    const { subject } = options;
+    let file;
+    try {
+        file = await open(path, constants.O_RDONLY | constants.O_NONBLOCK);
+    }
+    catch (error) {
+        const code = error.code;
+        throw new Error(`${subject} is unreadable${typeof code === "string" ? ` (${code})` : ""}`);
+    }
+    try {
+        const stat = await file.stat();
+        if (!stat.isFile())
+            throw new Error(`${subject} must be a regular file`);
+        if (stat.size > options.maxBytes)
+            throw new Error(options.oversize);
+        const bytes = Buffer.alloc(stat.size);
+        let offset = 0;
+        while (offset < bytes.length) {
+            const { bytesRead } = await file.read(bytes, offset, bytes.length - offset, offset);
+            if (!bytesRead)
+                throw new Error(`${subject} changed while reading`);
+            offset += bytesRead;
+        }
+        return bytes;
+    }
+    finally {
+        await file.close();
+    }
+}

package/dist/plugins/_shared/mediaFile.js

@@ -9,9 +9,10 @@
  * available (same pattern as googleDrive/googleSlides).
  */
 import { randomUUID } from "node:crypto";
-import { readFileSync, writeFileSync } from "node:fs";
+import { writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { basename, extname, join } from "node:path";
+import { readLocalFile } from "./localFile.js";
 const MIME_EXT = {
     "image/png": "png",
     "image/jpeg": "jpg",
@@ -66,23 +67,22 @@ const EXT_MIME = {
     webp: "image/webp",
     gif: "image/gif",
 };
+/** Larger than any provider accepts inline; a data URI past it only fails remotely. */
+const MAX_IMAGE_BYTES = 50 * 1024 * 1024;
 /**
  * Read a local image for an `image.edit` call: bytes + base64 + mime
- * (from the extension) + a `data:` URI for JSON APIs. Throws with the
- * plugin's name when the file can't be read so errors point at the
- * right tool.
+ * (from the extension) + a `data:` URI for JSON APIs. Errors carry the
+ * plugin's name so they point at the right tool.
  */
-export function readImageInput(imagePath, pluginName) {
+export async function readImageInput(imagePath, pluginName) {
     if (typeof imagePath !== "string" || imagePath.trim().length === 0) {
         throw new Error(`${pluginName}: imagePath is required`);
     }
-    let bytes;
-    try {
-        bytes = readFileSync(imagePath);
-    }
-    catch (err) {
-        throw new Error(`${pluginName}: cannot read image at ${imagePath} — ${err instanceof Error ? err.message : String(err)}`);
-    }
+    const bytes = await readLocalFile(imagePath, {
+        subject: `${pluginName}: imagePath`,
+        maxBytes: MAX_IMAGE_BYTES,
+        oversize: `${pluginName}: imagePath exceeds ${MAX_IMAGE_BYTES / (1024 * 1024)} MiB`,
+    });
     const ext = extname(imagePath).slice(1).toLowerCase();
     const mimeType = EXT_MIME[ext] ?? "image/png";
     const base64 = bytes.toString("base64");

package/dist/plugins/_shared/microsoftAuth.js

@@ -1,45 +1,18 @@
 import { AuthError, downloadResource, } from "runline";
-import { credentialRuntime } from "./credentialAdapter.js";
-import { microsoftCredentialType, microsoftMethod, microsoftUserBase, } from "./microsoftCredentials.js";
-export { microsoftDriveBase } from "./microsoftCredentials.js";
-export function isAppOnly(cfg) {
-    return microsoftMethod(cfg) === "appOnly";
-}
+import { credentialBroker } from "./credentialAdapter.js";
+import { jsonAnswer, requestFailed } from "./credentials.js";
+import { MICROSOFT_GRANT, microsoftCredential, microsoftEndpoint, microsoftUserBase, } from "./microsoftCredentials.js";
+export { microsoftCredential, microsoftDriveBase, } from "./microsoftCredentials.js";
 export function userBase(ctx) {
     return microsoftUserBase(ctx.connection.config);
 }
-function runtime(ctx, plugin, scopes) {
-    const cfg = ctx.connection.config;
-    const method = microsoftMethod(cfg);
-    if (method === "appOnly" &&
-        (!cfg.tenantId ||
-            ["common", "organizations", "consumers"].includes(cfg.tenantId)))
-        throw new AuthError("invalid_credentials");
-    return credentialRuntime(ctx, microsoftCredentialType(cfg, plugin, scopes), method, (current) => {
-        const c = current;
-        return [
-            microsoftMethod(c),
-            c.tenantId,
-            c.clientId,
-            c.clientSecret,
-            scopes,
-        ];
-    });
-}
-/** Compatibility token access uses the same grant runtime as resource requests. */
-export async function microsoftAccessToken(ctx, plugin, scopes) {
-    const { binding, transport } = runtime(ctx, plugin, scopes);
-    return transport.accessToken(binding);
-}
 export async function microsoftProbe(ctx, plugin, scopes) {
-    const { binding, transport } = runtime(ctx, plugin, scopes);
-    return transport.probe(binding);
+    return credentialBroker(ctx, microsoftCredential(plugin, scopes)).probe();
 }
 export async function graphResponse(ctx, plugin, scopes, method, path, body, contentType) {
     if (!path.startsWith("/") || path.startsWith("//"))
         throw new AuthError("request_not_allowed");
-    const { binding, transport } = runtime(ctx, plugin, scopes);
-    return transport.request(binding, {
+    return credentialBroker(ctx, microsoftCredential(plugin, scopes)).request({
         target: "graph",
         path: path.slice(1),
         method: method,
@@ -50,20 +23,16 @@ export async function graphResponse(ctx, plugin, scopes, method, path, body, con
         body,
     });
 }
-/** JSON and binary requests share the same destination, renewal and replay policy. */
+/**
+ * A Graph JSON request that must succeed; its answer is read by
+ * `jsonAnswer`. JSON and binary requests share the same destination,
+ * renewal and replay policy through `graphResponse`.
+ */
 export async function graphRequest(ctx, plugin, scopes, method, path, body) {
     const res = await graphResponse(ctx, plugin, scopes, method, path, body === undefined ? undefined : JSON.stringify(body), body === undefined ? undefined : "application/json");
     if (!res.ok)
-        throw new Error(`${plugin}: Graph request failed (HTTP ${res.status})`);
-    if (res.status === 204)
-        return { success: true };
-    const text = await res.text();
-    try {
-        return text ? JSON.parse(text) : { success: true };
-    }
-    catch {
-        throw new Error(`${plugin}: invalid Graph response`);
-    }
+        throw requestFailed(plugin, res.status);
+    return jsonAnswer(res);
 }
 /** Graph-issued signed download URLs carry their own authority, never a bearer header. */
 export async function microsoftDownload(value) {
@@ -90,8 +59,23 @@ export async function microsoftDownload(value) {
         fetch: globalThis.fetch,
     });
 }
-/** Setup help shown by the OAuth wizard for all Microsoft plugins. */
-export function microsoftSetupHelp(apiName) {
+/**
+ * A Microsoft Graph plugin's OAuth declaration: the multi-tenant endpoints,
+ * `offline_access` for a refresh token, the grant every Graph plugin
+ * shares, and setup steps naming the Graph permissions it needs
+ * (`permissions`, e.g. "Calendars.Read").
+ */
+export function microsoftOAuth(scopes, permissions) {
+    return {
+        grant: MICROSOFT_GRANT,
+        authUrl: microsoftEndpoint("common", "authorize"),
+        tokenUrl: microsoftEndpoint("common", "token"),
+        scopes: [...scopes, "offline_access"],
+        setupHelp: setupHelp(permissions),
+    };
+}
+/** The OAuth wizard's steps for a Microsoft plugin. */
+function setupHelp(permissions) {
     return [
         `You need a Microsoft Entra (Azure AD) app registration. One-time, ~5 minutes.`,
         "",
@@ -100,7 +84,7 @@ export function microsoftSetupHelp(apiName) {
         "2. Add a Web redirect URI (Authentication → Add platform → Web):",
         "     {{redirectUri}}",
         "3. Certificates & secrets → New client secret → copy the VALUE (not the Secret ID).",
-        `4. API permissions → Add → Microsoft Graph → Delegated → add the ${apiName} scopes,`,
+        `4. API permissions → Add → Microsoft Graph → Delegated → add the ${permissions} scopes,`,
         "   then 'Grant admin consent'.",
         "5. Paste the Application (client) ID and the client secret VALUE below.",
     ];

package/dist/plugins/_shared/microsoftCredentials.js

@@ -1,5 +1,13 @@
-import { AuthError, OAuthGrantSchema, } from "runline";
-import * as t from "typebox";
+import { AuthError, } from "runline";
+import { grantSchema, pathSegment } from "./credentials.js";
+/** The grant every Microsoft Graph plugin's delegated consent belongs to. */
+export const MICROSOFT_GRANT = "microsoft";
+/** A tenant's OAuth endpoint on the Microsoft identity platform. */
+export function microsoftEndpoint(tenant, leg) {
+    if (!/^[a-zA-Z0-9.-]+$/.test(tenant))
+        throw new AuthError("invalid_credentials");
+    return `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/${leg}`;
+}
 /** Compatibility inference is confined to legacy configs without an explicit method. */
 export function microsoftMethod(cfg) {
     if (cfg.authMethod !== undefined) {
@@ -16,25 +24,44 @@ export function microsoftUserBase(cfg) {
         return "/me";
     if (!cfg.userUpn)
         throw new AuthError("invalid_credentials");
-    return `/users/${encodeURIComponent(cfg.userUpn)}`;
+    return `/users/${pathSegment(cfg.userUpn)}`;
 }
 export function microsoftDriveBase(cfg) {
     if (cfg.driveId)
-        return `/drives/${encodeURIComponent(cfg.driveId)}`;
+        return `/drives/${pathSegment(cfg.driveId)}`;
     if (cfg.siteId)
-        return `/sites/${encodeURIComponent(cfg.siteId)}/drive`;
+        return `/sites/${pathSegment(cfg.siteId)}/drive`;
     return `${microsoftUserBase(cfg)}/drive`;
 }
+/**
+ * A Microsoft plugin's credential declaration. App-only signs for one
+ * tenant's directory, so a multi-tenant authority is refused here, where
+ * every signer reads it.
+ */
+export function microsoftCredential(plugin, scopes) {
+    return (config) => {
+        const cfg = config;
+        const method = microsoftMethod(cfg);
+        if (method === "appOnly" &&
+            (!cfg.tenantId ||
+                ["common", "organizations", "consumers"].includes(cfg.tenantId)))
+            throw new AuthError("invalid_credentials");
+        return {
+            type: microsoftCredentialType(cfg, plugin, scopes),
+            method,
+            application: {
+                clientId: cfg.clientId,
+                clientSecret: cfg.clientSecret,
+            },
+        };
+    };
+}
 /** Scope-appropriate probes never require User.Read merely to check mail/calendar/files. */
 export function microsoftCredentialType(cfg, plugin, scopes) {
-    const tenant = cfg.tenantId || "common";
-    if (!/^[a-zA-Z0-9.-]+$/.test(tenant))
-        throw new AuthError("invalid_credentials");
     const endpoint = {
-        url: `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token`,
+        url: microsoftEndpoint(cfg.tenantId || "common", "token"),
         clientAuthentication: "client_secret_post",
     };
-    const schema = t.Object({ grant: t.Optional(OAuthGrantSchema) }, { additionalProperties: false });
     const methods = Object.fromEntries(["delegated", "appOnly"].map((method) => {
         let probe;
         const selected = { ...cfg, authMethod: method };
@@ -59,13 +86,13 @@ export function microsoftCredentialType(cfg, plugin, scopes) {
         return [
             method,
             {
-                schema,
+                schema: grantSchema,
                 authentication: {
                     kind: "oauth2",
-                    grantField: "grant",
-                    renewal: method === "delegated"
-                        ? "refresh"
-                        : "clientCredentials",
+                    field: "grant",
+                    ...(method === "delegated"
+                        ? { renewal: "refresh", grant: MICROSOFT_GRANT }
+                        : { renewal: "clientCredentials" }),
                     definition: {
                         id: "microsoft.oauth",
                         provider: "microsoft",

package/dist/plugins/_shared/provider.js

@@ -1,6 +1,6 @@
 /**
- * Provider helpers: total readers for unshaped JSON, path-segment safety,
- * and bounded text or binary body reads.
+ * Provider helpers: total readers for unshaped JSON, and bounded text or
+ * binary body reads.
  *
  * The readers are total by design. These payloads are deep and change without
  * notice, so a missing or wrongly-typed field yields the empty value for its
@@ -34,18 +34,6 @@ export function numOrNull(value) {
     return null;
 }
 export const num = (value, fallback) => numOrNull(value) ?? fallback;
-/**
- * One path segment, escaped. Caller-supplied ids reach a URL carrying a bearer
- * token, so a segment that could climb out of its position is refused outright
- * rather than encoded and hoped about.
- */
-export function seg(value, what, plugin) {
-    const raw = String(value ?? "").trim();
-    if (!raw || raw === "." || raw === ".." || /[/\\?#]/.test(raw)) {
-        throw new Error(`${plugin}: invalid ${what}`);
-    }
-    return encodeURIComponent(raw);
-}
 /**
  * Read a response body with a ceiling, so a hostile or broken endpoint cannot
  * make the process hold an unbounded string.

package/dist/plugins/_shared/shiftCloud.js

@@ -1,6 +1,6 @@
 import * as t from "typebox";
-import { authedFetch } from "./authedFetch.js";
-import { readBounded } from "./provider.js";
+import { errorIdentifier, responseFailed } from "./credentials.js";
+export { pathSegment } from "./credentials.js";
 export const STRICT_OBJECT = { additionalProperties: false };
 export const STRICT_UPDATE_OBJECT = {
     additionalProperties: false,
@@ -29,61 +29,21 @@ export const SHIFT_API_URL = "https://cloud.shift-labs.ai";
 export function baseUrl() {
     return `${SHIFT_API_URL}/`;
 }
-/** Default deadline; endpoints that hold the request open pass their own. */
-export const SHIFT_REQUEST_TIMEOUT_MS = 60_000;
-const MAX_RESPONSE_BYTES = 16 * 1024 * 1024;
 /**
- * The transport for every request carrying a Shift API key. Redirects are
- * refused so the key never reaches another host; one deadline covers the
- * whole exchange including the body, in place of any caller signal; the
- * text body is read with a ceiling and returned buffered, so JSON and text
- * callers consume it as usual.
+ * A failed response, read as a Shift error envelope when it is one: the
+ * service's `code` (else its `type`) and the offending `param`.
  */
-export async function shiftFetch(input, init = {}, timeoutMs = SHIFT_REQUEST_TIMEOUT_MS) {
-    const response = await authedFetch(input, {
-        ...init,
-        signal: AbortSignal.timeout(timeoutMs),
+export function shiftError(plugin, response) {
+    return responseFailed(plugin, response, (body) => {
+        const error = body && typeof body === "object"
+            ? body.error
+            : undefined;
+        if (!error || typeof error !== "object")
+            return { code: error };
+        const shaped = error;
+        return {
+            code: errorIdentifier(shaped.code) ?? shaped.type,
+            param: shaped.param,
+        };
     });
-    const text = await readBounded(response, MAX_RESPONSE_BYTES, "Shift API response exceeds 16 MiB");
-    return new Response(text || null, {
-        status: response.status,
-        statusText: response.statusText,
-        headers: response.headers,
-    });
-}
-export function apiKey(ctx) {
-    const key = ctx.connection.config.apiKey;
-    if (typeof key !== "string" || !key) {
-        throw new Error("Shift Labs apiKey is required");
-    }
-    return key;
-}
-export async function request(ctx, path, init = {}, timeoutMs = SHIFT_REQUEST_TIMEOUT_MS) {
-    const headers = new Headers(init.headers);
-    headers.set("authorization", `Bearer ${apiKey(ctx)}`);
-    if (init.body && !headers.has("content-type")) {
-        headers.set("content-type", "application/json");
-    }
-    const response = await shiftFetch(new URL(path, baseUrl()), { ...init, headers }, timeoutMs);
-    if (!response.ok) {
-        throw new Error(`Shift Labs API error ${response.status}: ${await response.text()}`);
-    }
-    if (response.status === 204)
-        return undefined;
-    return (await response.json());
-}
-export function pathSegment(value) {
-    return encodeURIComponent(value);
-}
-export function listParams(input) {
-    const params = new URLSearchParams();
-    for (const [key, value] of Object.entries((input ?? {}))) {
-        if (value !== undefined)
-            params.set(key, String(value));
-    }
-    return params;
-}
-export function withQuery(path, params) {
-    const query = params.toString();
-    return query ? `${path}?${query}` : path;
 }

package/dist/plugins/_shared/shiftCredentials.js

@@ -0,0 +1,83 @@
+import { AuthError, } from "runline";
+import { credentialRequest, staticCredential } from "./credentials.js";
+import { SHIFT_API_URL, shiftError } from "./shiftCloud.js";
+/**
+ * The Shift family (shiftAtlas, shiftBwm, shiftCrm, shiftObjects,
+ * shiftPages, shiftWork) signs with one Shift API key, as a bearer, beneath
+ * the cloud API's /v1 surface. Each plugin may name its own probe: not every
+ * key reaches every service. Plugins whose service holds requests open
+ * (shiftOcr, shiftTranscription) declare the target's own deadline.
+ */
+export function shiftCredential(options = {}) {
+    const { probe, timeoutMs, maxResponseBytes } = options;
+    return staticCredential({
+        id: "shift",
+        auth: { kind: "bearer" },
+        local: { secret: "apiKey" },
+        targets: {
+            api: {
+                baseUrl: `${SHIFT_API_URL}/v1/`,
+                methods: ["GET", "POST", "PATCH", "PUT", "DELETE"],
+                allowedHeaders: ["Idempotency-Key"],
+                ...(timeoutMs !== undefined ? { timeoutMs } : {}),
+                ...(maxResponseBytes !== undefined ? { maxResponseBytes } : {}),
+            },
+        },
+        ...(probe
+            ? {
+                probe: {
+                    target: "api",
+                    path: probe,
+                    method: "GET",
+                    acceptedStatuses: [200],
+                },
+            }
+            : {}),
+    });
+}
+/** An absolute /v1/... route as a path beneath the Shift target. */
+export function shiftPath(route) {
+    if (!route.startsWith("/v1/"))
+        throw new AuthError("request_not_allowed");
+    return route.slice("/v1/".length);
+}
+/**
+ * A Shift plugin's credential and its request function, bound together so
+ * a plugin cannot sign with one declaration and declare another.
+ */
+export function shiftClient(plugin, options) {
+    const credential = shiftCredential(options);
+    return {
+        credential,
+        request: (ctx, route, init) => shiftRequest(ctx, credential, plugin, route, init),
+    };
+}
+/**
+ * One Shift API call through the declared credential. A body is JSON text;
+ * an empty answer, as the Shift API contract has it, is no value. `T` is the
+ * caller's statement of the answer's shape, unchecked.
+ */
+export async function shiftRequest(ctx, declaration, plugin, route, init = {}) {
+    const response = await credentialRequest(ctx, declaration, {
+        target: "api",
+        path: shiftPath(route),
+        method: (init.method ?? "GET"),
+        query: init.query,
+        ...(init.body !== undefined
+            ? { body: init.body, headers: { "Content-Type": "application/json" } }
+            : {}),
+    });
+    if (!response.ok)
+        throw await shiftError(plugin, response);
+    if (response.status === 204)
+        return undefined;
+    const text = await response.text();
+    if (!text)
+        return undefined;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new AuthError("invalid_response");
+    }
+}