visionai-sdk-python 2.2.0.dev1__py3-none-any.whl → 2.2.0.dev3__py3-none-any.whl

visionai_sdk_python/_base.py

@@ -5,16 +5,7 @@ import httpx
 
 from ._jwt_verifier import JwtVerifier
 from .constants import resolve_allowed_issuers
-from .exceptions import (
-    APIError,
-    AuthenticationError,
-    ClientError,
-    NetworkError,
-    PermissionDeniedError,
-    RateLimitedError,
-    ServerError,
-    VisionaiSDKError,
-)
+from .exceptions import raise_for_status
 
 if TYPE_CHECKING:
     from .auth.credentials import AsyncClientCredentials, ClientCredentials
@@ -53,8 +44,9 @@ class _BaseClient:
             max_keepalive_connections: Maximum number of idle keep-alive connections.
             credential: A ``ClientCredentials`` / ``AsyncClientCredentials`` whose
                 token every call uses; shareable between clients. Without it the
-                client keeps the token from ``auth.login()`` / ``auth.get_access_token()``
-                or ``set_token()``.
+                client keeps the token from ``auth.login()`` or ``set_token()``;
+                ``auth.get_access_token()`` installs a credential. The last explicit
+                authentication wins.
         """
         if not auth_url.strip():
             raise ValueError("auth_url must not be empty")
@@ -83,27 +75,49 @@ class _BaseClient:
         self._access_token: str | None = None
         self._token_expires_at: float | None = None  # monotonic time
         self._credentials: dict | None = None
-        self._credentials_type: Literal["login", "client"] | None = None
+        self._credentials_type: Literal["login"] | None = None
+
+    @property
+    def credential(self) -> "ClientCredentials | AsyncClientCredentials | None":
+        """The credential this client was built with, for callers that need the
+        raw token themselves (a WebSocket upgrade, another HTTP library)."""
+        return self._credential
 
     @staticmethod
     def _build_url(base_url: str, path: str) -> str:
         """Join a base URL and a path, normalizing slashes."""
         return f"{base_url.rstrip('/')}/{path.lstrip('/')}"
 
-    def _vlm_base(self) -> str:
+    @staticmethod
+    def _full_url(url: str) -> str:
+        """``request()`` takes a full URL: the client has two bases (``auth_url``,
+        ``vlm_url``), so a bare path would not say which one is meant."""
+        if "://" not in url:
+            raise ValueError(f"request() needs a full URL, got {url!r}")
+        return url
+
+    def _with_auth(self, kwargs: dict, token: str) -> dict:
+        """``kwargs`` for httpx with the bearer header; the client's token wins."""
+        headers = httpx.Headers(kwargs.get("headers"))
+        headers["Authorization"] = f"Bearer {token}"  # case-insensitive: one header
+        return {**kwargs, "headers": headers}
+
+    @staticmethod
+    def _resendable(kwargs: dict) -> bool:
+        """Whether the body can be sent a second time (streams and files cannot)."""
+        content = kwargs.get("content")
+        if content is not None and not isinstance(content, (bytes, str)):
+            return False
+        if kwargs.get("files") is not None:
+            return False
+        data = kwargs.get("data")
+        return data is None or isinstance(data, dict)
+
+    def _require_vlm_url(self) -> str:
         if self.vlm_url is None:
             raise ValueError("vlm_url is required for VLM calls; pass it to the client")
         return self.vlm_url
 
-    @staticmethod
-    def _map_transport_error(error: httpx.RequestError) -> VisionaiSDKError:
-        """The SDK exception for an httpx request that never got a response."""
-        if isinstance(error, httpx.TimeoutException):
-            return NetworkError("Request timed out")
-        if isinstance(error, httpx.NetworkError):
-            return NetworkError(f"Network error: {error}")
-        return VisionaiSDKError(f"Request failed: {error}")
-
     @staticmethod
     def _build_auth_header(access_token: str) -> dict[str, str]:
         """Build authorization header."""
@@ -116,16 +130,20 @@ class _BaseClient:
         access_token: str,
         expires_in: int,
         credentials: dict | None = None,
-        credentials_type: Literal["login", "client"] | None = None,
+        credentials_type: Literal["login"] | None = None,
     ) -> None:
-        """Store token and credentials for auto-refresh.
+        """Use this token from now on; a credential set earlier is dropped.
+
+        The last explicit authentication wins, in both directions.
 
         Args:
             access_token: JWT access token.
             expires_in: Token expiration time in seconds.
             credentials: Optional credentials for auto-refresh.
-            credentials_type: Type of credentials ("login" or "client").
+            credentials_type: "login" for email / password credentials; client
+                credentials live in a ``ClientCredentials`` on the client instead.
         """
+        self._credential = None
         self._access_token = access_token
         self._token_expires_at = time.monotonic() + expires_in
         self._credentials = credentials
@@ -201,38 +219,5 @@ class _BaseClient:
 
     @staticmethod
     def _handle_response(response: httpx.Response) -> httpx.Response:
-        """Raise SDK-specific exceptions for non-2xx responses.
-
-        Raises:
-            AuthenticationError: If the server returns 401
-            PermissionDeniedError: If the server returns 403
-            ClientError: If the server returns any other 4xx
-            ServerError: If the server returns 5xx
-            APIError: If the server returns any other non-2xx status
-        """
-        try:
-            response.raise_for_status()
-        except httpx.HTTPStatusError as e:
-            body = None
-            if e.response.content:
-                try:
-                    body = e.response.json()
-                except Exception:
-                    pass
-            if isinstance(body, dict):
-                detail: str = body.get("detail") or body.get("message") or str(e)
-            else:
-                detail = str(e)
-            status = e.response.status_code
-            if status == 401:
-                raise AuthenticationError(detail) from e
-            if status == 403:
-                raise PermissionDeniedError(detail) from e
-            if status == 429:
-                raise RateLimitedError(detail) from e
-            if 400 <= status < 500:
-                raise ClientError(status, detail) from e
-            if 500 <= status < 600:
-                raise ServerError(status, detail) from e
-            raise APIError(status, detail) from e
-        return response
+        """Raise the SDK exception for a non-2xx response (``exceptions.raise_for_status``)."""
+        return raise_for_status(response)

visionai_sdk_python/async_client.py

@@ -4,7 +4,7 @@ from ._base import _BaseClient
 from ._request_attribution import merge_request_attribution
 from .auth.async_resource import AsyncAuthResource
 from .auth.credentials import AsyncClientCredentials
-from .exceptions import AuthenticationError
+from .exceptions import AuthenticationError, from_transport_error
 from .vlm.async_resource import AsyncVLMResource
 
 
@@ -19,7 +19,10 @@ class AsyncClient(_BaseClient):
         max_connections: int = 100,
         max_keepalive_connections: int = 20,
         credential: AsyncClientCredentials | None = None,
+        http_client: httpx.AsyncClient | None = None,
     ) -> None:
+        """See ``_BaseClient``; ``http_client`` is an httpx.AsyncClient to send through
+        (tests, shared pools); the client closes only the one it created."""
         super().__init__(
             auth_url=auth_url,
             vlm_url=vlm_url,
@@ -30,7 +33,7 @@ class AsyncClient(_BaseClient):
             max_keepalive_connections=max_keepalive_connections,
             credential=credential,
         )
-        self._client = httpx.AsyncClient(
+        self._client = http_client or httpx.AsyncClient(
             verify=self.verify_ssl,
             timeout=self.timeout,
             limits=httpx.Limits(
@@ -38,6 +41,7 @@ class AsyncClient(_BaseClient):
                 max_keepalive_connections=self.max_keepalive_connections,
             ),
         )
+        self._http_owner = http_client is None  # a client we built is ours to close
         # Register the different function resource
         self.auth = AsyncAuthResource(self)
         self.vlm = AsyncVLMResource(self)
@@ -48,12 +52,42 @@ class AsyncClient(_BaseClient):
         try:
             response = await self._client.request(method, url, **kwargs)
         except httpx.RequestError as e:
-            raise self._map_transport_error(e) from e
+            raise from_transport_error(e) from e
         return self._handle_response(response)
 
+    async def request(self, method: str, url: str, **kwargs) -> httpx.Response:
+        """Send any request with this client's bearer token.
+
+        ``url`` is a full URL (the client has two bases); ``kwargs`` go to httpx.
+        With a ``credential``, a 401 buys one retry with the credential's current
+        token, which it replaces when the rejected one is old enough to have been
+        revoked (``REPLACE_COOLDOWN_S``); a 401 on the retry raises. Without a
+        credential, or with a body that cannot be sent twice (a stream or a
+        file), a 401 raises.
+
+        Raises:
+            ValueError: ``url`` is not a full URL.
+            AuthenticationError: No token, or the fresh one was refused too.
+            RateLimitedError, NetworkError, ServerError, ClientError: As the
+                resource methods.
+        """
+        url = self._full_url(url)
+        token = await self._ensure_token()
+        try:
+            return await self._request(method, url, **self._with_auth(kwargs, token))
+        except AuthenticationError:
+            if self._credential is None or not self._resendable(kwargs):
+                raise
+            self._credential.invalidate(token)
+            replacement = (await self._credential.get_token()).token
+            if replacement == token:
+                raise
+        return await self._request(method, url, **self._with_auth(kwargs, replacement))
+
     async def close(self) -> None:
-        """Close the HTTP client and release connections."""
-        await self._client.aclose()
+        """Close the HTTP client this client created and release its connections."""
+        if self._http_owner:
+            await self._client.aclose()
 
     async def __aenter__(self) -> "AsyncClient":
         """Async context manager entry."""
@@ -64,7 +98,9 @@ class AsyncClient(_BaseClient):
         await self.close()
 
     async def _refresh_token(self) -> None:
-        """Refresh token using stored credentials.
+        """Refresh the token with the stored login credentials.
+
+        Client credentials refresh through the credential object instead.
 
         Raises:
             AuthenticationError: If no credentials are stored or refresh fails.
@@ -72,26 +108,19 @@ class AsyncClient(_BaseClient):
         if self._credentials is None or self._credentials_type is None:
             raise AuthenticationError("No credentials available for token refresh")
 
-        if self._credentials_type == "login":
-            await self.auth.login(
-                email=self._credentials["email"],
-                password=self._credentials["password"],
-            )
-        elif self._credentials_type == "client":
-            await self.auth.get_access_token(
-                client_id=self._credentials["client_id"],
-                client_secret=self._credentials["client_secret"],
-            )
+        await self.auth.login(
+            email=self._credentials["email"],
+            password=self._credentials["password"],
+        )
 
-    async def _ensure_token(self) -> None:
-        """Ensure a valid token is available, refreshing if necessary.
+    async def _ensure_token(self) -> str:
+        """The token to send: the credential's, else the stored one, refreshed if expiring.
 
         Raises:
             AuthenticationError: If no token is available or token expired without credentials.
         """
         if self._credential is not None:
-            self._access_token = (await self._credential.get_token()).token
-            return
+            return (await self._credential.get_token()).token
         if self._access_token is None:
             raise AuthenticationError(
                 "Not authenticated. Call login() or get_access_token() first."
@@ -103,3 +132,4 @@ class AsyncClient(_BaseClient):
                     "Token expired and no credentials available for refresh"
                 )
             await self._refresh_token()
+        return self._access_token

visionai_sdk_python/auth/_mixin.py

@@ -97,7 +97,7 @@ class AuthMixin:
         Args:
             response_data: Response JSON data
             credentials: Credentials dict for auto-refresh
-            credentials_type: Type of credentials ("login" or "client")
+            credentials_type: Type of credentials ("login")
 
         Returns:
             Parsed TokenResponse

visionai_sdk_python/auth/async_resource.py

@@ -1,6 +1,5 @@
 """Authentication resource for async operations."""
 
-import time
 from typing import TYPE_CHECKING
 
 import jwt
@@ -29,13 +28,16 @@ class AsyncAuthResource(AuthMixin):
         self._sdk_client = client
 
     async def get_access_token(
-        self, client_id: str, client_secret: str
+        self, client_id: str, client_secret: str, *, force_refresh: bool = False
     ) -> TokenResponse:
         """Get access token using client credentials flow.
 
-        The token is stored internally and will be used automatically for subsequent
-        API calls. If the token expires, it will be automatically refreshed.
-        Calling this again with the same credentials returns the cached token.
+        The client keeps the resulting credential and uses it for subsequent API
+        calls, minting a new token when the current one expires. Calling this
+        again with the same client credentials returns the cached token;
+        ``force_refresh=True`` mints a new one. A later ``login()`` or
+        ``set_token()`` replaces the credential: the last explicit
+        authentication wins.
 
         New code should build a ``ClientCredentials`` / ``AsyncClientCredentials``
         and pass it as ``credential=`` to the client instead; this method stays for
@@ -44,6 +46,7 @@ class AsyncAuthResource(AuthMixin):
         Args:
             client_id: OAuth client ID
             client_secret: OAuth client secret
+            force_refresh: Mint a new token even if a fresh one is cached.
 
         Returns:
             TokenResponse with access_token, expires_in, and token_type
@@ -70,16 +73,15 @@ class AsyncAuthResource(AuthMixin):
                 client_secret,
                 http=self._sdk_client._client,
             )
-            self._sdk_client._credential = credential
-        token = await credential.get_token()
-        self._sdk_client._store_token(
+        token = await credential.get_token(force_refresh=force_refresh)
+        # Installed only once it works, and over a login() / set_token() token:
+        # the last explicit authentication wins.
+        self._sdk_client._credential = credential
+        return TokenResponse(
             access_token=token.token,
-            expires_in=max(int(token.expires_on - time.monotonic()), 0),
-            credentials={"client_id": client_id, "client_secret": client_secret},
-            credentials_type="client",
+            expires_in=token.expires_in(),
+            token_type=token.token_type,
         )
-        assert credential.last_response is not None
-        return credential.last_response
 
     async def login(self, email: str, password: str) -> TokenResponse:
         """Login with email and password to get JWT token.

visionai_sdk_python/auth/credentials.py

@@ -1,8 +1,10 @@
 """One client-credentials token for every client and caller in a process.
 
-Platform mints at most 50 tokens per client per month, so the token is cached
-until five minutes before it expires, one mint runs at a time, a 401 buys one
-replacement, and a 429 stops minting for an hour.
+A mint is a round trip to Platform and, on sites that cap client tokens, a
+scarce one, so the token is cached until shortly before it expires, one mint
+runs at a time, a refresh that fails keeps the current token while Platform
+still accepts it, a 401 replaces a token that is old enough to have been
+revoked, and a 429 stops minting for an hour.
 """
 
 from __future__ import annotations
@@ -20,31 +22,43 @@ import httpx
 from .._base import _BaseClient
 from .._request_attribution import merge_request_attribution
 from ..endpoints import AuthEndpoint
-from ..exceptions import RateLimitedError, VisionaiSDKError
+from ..exceptions import (
+    RateLimitedError,
+    VisionaiSDKError,
+    from_transport_error,
+    raise_for_status,
+)
 from .models import TokenResponse
 
 logger = logging.getLogger(__name__)
 
-# A token counts as expired this long before Platform says so.
+# A token is refreshed this long before it expires, or at half its lifetime when
+# that is sooner, so a token is never served after Platform stops accepting it.
 REFRESH_BUFFER_S = 300
-# Anything shorter would mint on every call; Platform issues 3-day tokens.
-MIN_EXPIRES_IN_S = 2 * REFRESH_BUFFER_S
-# After a 429 (the monthly quota is used up) no mint is tried for this long.
-QUOTA_COOLDOWN_S = 3600
+# After a 429 no mint is tried for this long.
+RATE_LIMIT_COOLDOWN_S = 3600
+# A 401 on a token minted less than this long ago does not replace it.
+REPLACE_COOLDOWN_S = 30 * 60
 
 _now = time.monotonic
 
 
 @dataclass(frozen=True)
 class AccessToken:
-    """A bearer token and the ``time.monotonic()`` second it expires at."""
+    """A bearer token with the ``time.monotonic()`` seconds it expires at and was issued."""
 
     token: str
     expires_on: float
+    token_type: str
+    issued_at: float
+
+    def expires_in(self) -> int:
+        """Seconds left before ``expires_on``, never negative."""
+        return max(int(self.expires_on - _now()), 0)
 
 
 class _Credentials:
-    """What the sync and async variants share: the cache, the 401 and 429 rules."""
+    """What the sync and async variants share: the cache, the refresh, 401 and 429 rules."""
 
     def __init__(self, auth_url: str, client_id: str, client_secret: str) -> None:
         if not auth_url.strip():
@@ -57,12 +71,9 @@ class _Credentials:
         self.client_id = client_id.strip()
         self._client_secret = client_secret
         self._url = _BaseClient._build_url(self.auth_url, AuthEndpoint.CLIENT_TOKEN)
-        self._token: AccessToken | None = None
-        #: The last token endpoint response, for callers that want ``token_type`` too.
-        self.last_response: TokenResponse | None = None
-        # True while the cached token is the replacement a 401 bought.
-        self._replaced = False
+        self._current: AccessToken | None = None  # the token this credential holds
         self._blocked_until = 0.0
+        self._minting = False  # a mint is in flight (set under the lock)
 
     def is_for(self, client_id: str, client_secret: str) -> bool:
         """True when this credential was built for exactly these client credentials."""
@@ -70,63 +81,89 @@ class _Credentials:
             self._client_secret, client_secret
         )
 
-    def _cached(self) -> AccessToken | None:
-        if self._token and _now() < self._token.expires_on - REFRESH_BUFFER_S:
-            return self._token
+    def _fresh(self) -> AccessToken | None:
+        """The current token while it is not yet due for a refresh."""
+        token = self._current
+        if token is None:
+            return None
+        buffer = min(REFRESH_BUFFER_S, (token.expires_on - token.issued_at) / 2)
+        return token if _now() < token.expires_on - buffer else None
+
+    def _valid(self) -> AccessToken | None:
+        """The current token while Platform still accepts it, due for a refresh or not."""
+        if self._current and _now() < self._current.expires_on:
+            return self._current
         return None
 
-    def _mint_request(self) -> dict[str, Any]:
-        """kwargs for the client-token POST; refuses while a 429 cooldown runs."""
+    def _begin_mint(self) -> dict[str, Any]:
+        """First half of a mint: the 429 gate, then the kwargs for the client-token POST."""
         if _now() < self._blocked_until:
             raise RateLimitedError(
-                "client-token quota used up; not minting until the cooldown ends"
+                "client-token requests are rate limited; not minting until the cooldown ends"
             )
-        if self._token is not None:
-            # Natural refresh: the next 401 may buy one replacement again.
-            self._replaced = False
         kwargs: dict[str, Any] = {
             "json": {"client_id": self.client_id, "client_secret": self._client_secret}
         }
         merge_request_attribution(kwargs)
         return kwargs
 
-    def _store(self, response: httpx.Response) -> AccessToken:
+    def _finish_mint(self, response: httpx.Response) -> AccessToken:
+        """Second half of a mint: the response becomes the current token, or raises."""
         try:
-            _BaseClient._handle_response(response)
+            raise_for_status(response)
         except RateLimitedError:
-            self._blocked_until = _now() + QUOTA_COOLDOWN_S
+            self._blocked_until = _now() + RATE_LIMIT_COOLDOWN_S
             raise
         try:
             parsed = TokenResponse(**response.json())
         except (ValueError, TypeError) as e:
             raise VisionaiSDKError(f"client-token response is not a token: {e}") from e
-        self.last_response = parsed
-        self._token = AccessToken(
-            parsed.access_token, _now() + max(parsed.expires_in, MIN_EXPIRES_IN_S)
+        now = _now()
+        self._current = AccessToken(
+            parsed.access_token, now + parsed.expires_in, parsed.token_type, now
         )
         logger.info(
             "platform token minted",
             extra={"client_id": self.client_id, "expires_in": parsed.expires_in},
         )
-        return self._token
+        return self._current
+
+    def _after_failed_refresh(self, error: VisionaiSDKError) -> AccessToken:
+        """A refresh failed: keep serving the current token while it is valid, else raise."""
+        valid = self._valid()
+        if valid is None:
+            raise error
+        logger.warning(
+            "token refresh failed; using the current token until it expires",
+            extra={
+                "client_id": self.client_id,
+                "error": str(error),
+                "expires_in": valid.expires_in(),
+            },
+        )
+        return valid
 
     def invalidate(self, token: str) -> bool:
         """Report a 401 for ``token``. True: dropped, so the next ``get_token()`` mints.
 
-        A 401 for a token already replaced changes nothing. A 401 for the
-        replacement itself is not expiry but a client or allowlist problem that
-        another mint would not fix, so that token stays until its own refresh.
+        A late report for a token no longer held changes nothing. A token minted
+        less than ``REPLACE_COOLDOWN_S`` ago is kept: a 401 that soon is a client or
+        allowlist problem another mint would not fix, and the cooldown bounds how
+        often a persistent 401 can mint. While a mint is in flight the report is
+        already being acted on.
         """
-        if self._token is None or token != self._token.token:
+        if self._current is None or token != self._current.token:
             return False
-        if self._replaced:
-            logger.error(
-                "replacement token rejected too; keeping it until it expires",
+        if self._minting:
+            return True
+        if _now() - self._current.issued_at < REPLACE_COOLDOWN_S:
+            logger.warning(
+                "401 on a token minted %d s ago; keeping it until the cooldown ends",
+                int(_now() - self._current.issued_at),
                 extra={"client_id": self.client_id},
             )
             return False
-        self._token = None
-        self._replaced = True
+        self._current = None
         return True
 
 
@@ -149,32 +186,43 @@ class ClientCredentials(_Credentials):
     ) -> None:
         super().__init__(auth_url, client_id, client_secret)
         self._http = http or httpx.Client(verify=verify_ssl, timeout=timeout)
-        self._owns_http = http is None
+        self._http_owner = http is None  # a client we built is ours to close
         self._lock = threading.Lock()
 
-    def get_token(self) -> AccessToken:
-        """The cached token, or a fresh one when it is within five minutes of expiry.
+    def get_token(self, *, force_refresh: bool = False) -> AccessToken:
+        """The cached token, refreshed shortly before it expires.
+
+        ``force_refresh=True`` mints even while the cached token is fresh. A refresh
+        that fails keeps serving the current token while Platform still accepts it.
 
         Raises:
             AuthenticationError: Platform refused the client credentials (401).
-            RateLimitedError: The monthly mint quota is used up (429), or a 429 was
-                seen less than an hour ago.
+            RateLimitedError: Platform answered 429, or did so less than an hour ago.
             NetworkError: Platform could not be reached.
             VisionaiSDKError: Any other failure.
         """
         with self._lock:
-            cached = self._cached()
-            if cached is not None:
-                return cached
-            kwargs = self._mint_request()
+            if not force_refresh:
+                fresh = self._fresh()
+                if fresh is not None:
+                    return fresh
+            self._minting = True
             try:
-                response = self._http.post(self._url, **kwargs)
-            except httpx.RequestError as e:
-                raise _BaseClient._map_transport_error(e) from e
-            return self._store(response)
+                kwargs = self._begin_mint()
+                try:
+                    response = self._http.post(self._url, **kwargs)
+                except httpx.RequestError as e:
+                    raise from_transport_error(e) from e
+                return self._finish_mint(response)
+            except VisionaiSDKError as e:
+                if force_refresh:
+                    raise
+                return self._after_failed_refresh(e)
+            finally:
+                self._minting = False
 
     def close(self) -> None:
-        if self._owns_http:
+        if self._http_owner:
             self._http.close()
 
     def __enter__(self) -> ClientCredentials:
@@ -204,27 +252,37 @@ class AsyncClientCredentials(_Credentials):
     ) -> None:
         super().__init__(auth_url, client_id, client_secret)
         self._http = http or httpx.AsyncClient(verify=verify_ssl, timeout=timeout)
-        self._owns_http = http is None
+        self._http_owner = http is None  # a client we built is ours to close
         self._lock = asyncio.Lock()
 
-    async def get_token(self) -> AccessToken:
-        """The cached token, or a fresh one when it is within five minutes of expiry.
+    async def get_token(self, *, force_refresh: bool = False) -> AccessToken:
+        """The cached token, refreshed shortly before it expires.
 
-        Concurrent callers wait for one mint. Raises as ``ClientCredentials.get_token``.
+        Concurrent callers wait for one mint. Behaves and raises as
+        ``ClientCredentials.get_token``.
         """
         async with self._lock:
-            cached = self._cached()
-            if cached is not None:
-                return cached
-            kwargs = self._mint_request()
+            if not force_refresh:
+                fresh = self._fresh()
+                if fresh is not None:
+                    return fresh
+            self._minting = True
             try:
-                response = await self._http.post(self._url, **kwargs)
-            except httpx.RequestError as e:
-                raise _BaseClient._map_transport_error(e) from e
-            return self._store(response)
+                kwargs = self._begin_mint()
+                try:
+                    response = await self._http.post(self._url, **kwargs)
+                except httpx.RequestError as e:
+                    raise from_transport_error(e) from e
+                return self._finish_mint(response)
+            except VisionaiSDKError as e:
+                if force_refresh:
+                    raise
+                return self._after_failed_refresh(e)
+            finally:
+                self._minting = False
 
     async def aclose(self) -> None:
-        if self._owns_http:
+        if self._http_owner:
             await self._http.aclose()
 
     async def __aenter__(self) -> AsyncClientCredentials: