Function bodies 134 total

func gmailAuthError(err error) error {
	var authErr *googleapi.AuthRequiredError
	if isAuthErr(err, &authErr) {
		return output.WriteError(output.ExitCodeAuth, "auth_required", err.Error())
	}

	return output.WriteError(output.ExitCodeError, "gmail_error", err.Error())
}

func enforceActionPolicy(account, action string) error {
	p, err := config.ReadPolicy()
	if err != nil {
		return fmt.Errorf("read policy: %w", err)
	}

	account = normalizeEmail(account)
	action = strings.ToLower(strings.TrimSpace(action))

	for _, blocked := range p.BlockedAccounts {
		if blocked == account {
			return fmt.Errorf("account %q is blocked by policy", account)
		}
	}

	if len(p.AllowedActions) == 0 {
		return nil
	}

	for _, allowed := range p.AllowedActions {
		if allowed == action {
			return nil
		}
	}

	return fmt.Errorf("action %q is not allowed by policy", action)
}

func actionRequiresApproval(action string) (bool, error) {
	p, err := config.ReadPolicy()
	if err != nil {
		return false, fmt.Errorf("read policy: %w", err)
	}

	action = strings.ToLower(strings.TrimSpace(action))
	required := p.RequireApprovalActions
	if len(required) == 0 {
		required = defaultApprovalActions
	}

	for _, v := range required {
		if v == action {
			return true, nil
		}
	}

	return false, nil
}

func enforceRateLimit(action string, limit int, window time.Duration) error {
	if limit <= 0 || window <= 0 {
		return nil
	}

	action = strings.TrimSpace(action)
	if action == "" {
		return nil
	}

	path, err := rateLimitPath(action)
	if err != nil {
		return err
	}

	state, err := loadRateLimitState(path)
	if err != nil {
		return err
	}

	now := nowUTC()
	cutoff := now.Add(-window)

	kept := make([]string, 0, len(state.Timestamps)+1)
	for _, ts := range state.Timestamps {
		t, err := time.Parse(time.RFC3339, ts)
		if err != nil {
			continue
		}
		if !t.Before(cutoff) {
			kept = append(kept, ts)
		}
	}

	if len(kept) >= limit {
		return fmt.Errorf("rate limit exceeded for %s: max %d per %s", action, limit, window)
	}

	kept = append(kept, now.Format(time.RFC3339))
	state.Timestamps = kept

	return saveRateLimitState(path, state)
}

func rateLimitPath(action string) (string, error) {
	base, err := config.EnsureDir()
	if err != nil {
		return "", fmt.Errorf("resolve config dir: %w", err)
	}

	dir := filepath.Join(base, "ratelimit")
	if err := os.MkdirAll(dir, 0o700); err != nil {
		return "", fmt.Errorf("ensure ratelimit dir: %w", err)
	}

	safe := strings.NewReplacer("/", "_", " ", "_", ":", "_").Replace(action)
	if safe == "" {
		safe = "default"
	}

	return filepath.Join(dir, safe+".json"), nil
}

func loadRateLimitState(path string) (rateLimitState, error) {
	b, err := os.ReadFile(path) //nolint:gosec
	if err != nil {
		if os.IsNotExist(err) {
			return rateLimitState{}, nil
		}

		return rateLimitState{}, fmt.Errorf("read rate limit state: %w", err)
	}

	var st rateLimitState
	if err := json.Unmarshal(b, &st); err != nil {
		return rateLimitState{}, nil
	}

	return st, nil
}

func saveRateLimitState(path string, st rateLimitState) error {
	b, err := json.Marshal(st)
	if err != nil {
		return fmt.Errorf("encode rate limit state: %w", err)
	}

	tmp := path + ".tmp"
	if err := os.WriteFile(tmp, b, 0o600); err != nil {
		return fmt.Errorf("write rate limit state: %w", err)
	}

	if err := os.Rename(tmp, path); err != nil {
		return fmt.Errorf("commit rate limit state: %w", err)
	}

	return nil
}

func Execute(ctx context.Context, version string) error {
	cli := &CLI{}

	k, err := kong.New(cli,
		kong.Name("gog-lite"),
		kong.Description("AI-agent-friendly CLI for Gmail, Calendar, and Docs."),
		kong.UsageOnError(),
		kong.Vars{"version": resolveVersion(version)},
	)
	if err != nil {
		return fmt.Errorf("create parser: %w", err)
	}

	kctx, err := k.Parse(os.Args[1:])
	if err != nil {
		return err
	}

	// Bind context.Context as the interface type (not the concrete type).
	kctx.BindTo(ctx, (*context.Context)(nil))
	kctx.Bind(&cli.RootFlags)

	return kctx.Run()
}

func resolveVersion(version string) string {
	v := strings.TrimSpace(version)
	if v == "" {
		return "dev"
	}

	return v
}

func (c *SheetsGetCmd) Run(ctx context.Context, _ *RootFlags) error {
	if err := enforceActionPolicy(c.Account, "sheets.get"); err != nil {
		return output.WriteError(output.ExitCodePermission, "policy_denied", err.Error())
	}

	if err := enforceRateLimit("sheets.get", 120, time.Minute); err != nil {
		return output.WriteError(output.ExitCodeError, "rate_limited", err.Error())
	}

	svc, err := googleapi.NewSheetsReadOnly(ctx, c.Account)
	if err != nil {
		return sheetsAuthError(err)
	}

	resp, err := svc.Spreadsheets.Values.Get(c.SpreadsheetID, c.Range).Do()
	if err != nil {
		return writeGoogleAPIError("sheets_get_error", err)
	}

	return output.WriteJSON(os.Stdout, map[string]any{
		"spreadsheet_id": c.SpreadsheetID,
		"range":          resp.Range,
		"values":         resp.Values,
	})
}

func (c *SheetsUpdateCmd) Run(ctx context.Context, root *RootFlags) error {
	if err := enforceActionPolicy(c.Account, "sheets.update"); err != nil {
		return output.WriteError(output.ExitCodePermission, "policy_denied", err.Error())
	}

	valuesJSON := c.Values
	if c.ValuesStdin {
		s, err := readStdinWithLimit(maxStdinBytes)
		if err != nil {
			return output.WriteError(output.ExitCodeError, "stdin_error", fmt.Sprintf("read stdin: %v", err))
		}
		valuesJSON = s
	}

	var values [][]any
	if err := json.Unmarshal([]byte(valuesJSON), &values); err != nil {
		return output.WriteError(output.ExitCodeError, "invalid_values", fmt.Sprintf("parse values JSON: %v", err))
	}

	if root.DryRun {
		if err := appendAuditLog(root.AuditLog, auditEntry{
			Action:  "sheets.update",
			Account: normalizeEmail(c.Account),
			Target:  c.SpreadsheetID,
			DryRun:  true,
		}); err != nil {
			return output.WriteError(output.ExitCodeError, "audit_error", err.Error())
		}
		return output.WriteJSON(os.Stdout, m

func (c *SheetsAppendCmd) Run(ctx context.Context, root *RootFlags) error {
	if err := enforceActionPolicy(c.Account, "sheets.append"); err != nil {
		return output.WriteError(output.ExitCodePermission, "policy_denied", err.Error())
	}

	valuesJSON := c.Values
	if c.ValuesStdin {
		s, err := readStdinWithLimit(maxStdinBytes)
		if err != nil {
			return output.WriteError(output.ExitCodeError, "stdin_error", fmt.Sprintf("read stdin: %v", err))
		}
		valuesJSON = s
	}

	var values [][]any
	if err := json.Unmarshal([]byte(valuesJSON), &values); err != nil {
		return output.WriteError(output.ExitCodeError, "invalid_values", fmt.Sprintf("parse values JSON: %v", err))
	}

	if root.DryRun {
		if err := appendAuditLog(root.AuditLog, auditEntry{
			Action:  "sheets.append",
			Account: normalizeEmail(c.Account),
			Target:  c.SpreadsheetID,
			DryRun:  true,
		}); err != nil {
			return output.WriteError(output.ExitCodeError, "audit_error", err.Error())
		}
		return output.WriteJSON(os.Stdout, m

func sheetsAuthError(err error) error {
	var authErr *googleapi.AuthRequiredError
	if isAuthErr(err, &authErr) {
		return output.WriteError(output.ExitCodeAuth, "auth_required", err.Error())
	}
	return output.WriteError(output.ExitCodeError, "sheets_error", err.Error())
}

func (c *SlidesGetCmd) Run(ctx context.Context, _ *RootFlags) error {
	if err := enforceActionPolicy(c.Account, "slides.get"); err != nil {
		return output.WriteError(output.ExitCodePermission, "policy_denied", err.Error())
	}

	if err := enforceRateLimit("slides.get", 120, time.Minute); err != nil {
		return output.WriteError(output.ExitCodeError, "rate_limited", err.Error())
	}

	svc, err := googleapi.NewSlidesReadOnly(ctx, c.Account)
	if err != nil {
		return slidesAuthError(err)
	}

	if c.PageID != "" {
		page, err := svc.Presentations.Pages.Get(c.PresentationID, c.PageID).Do()
		if err != nil {
			return writeGoogleAPIError("slides_get_error", err)
		}

		return output.WriteJSON(os.Stdout, map[string]any{
			"object_id": page.ObjectId,
			"texts":     extractPageTexts(page.PageElements),
		})
	}

	pres, err := svc.Presentations.Get(c.PresentationID).Do()
	if err != nil {
		return writeGoogleAPIError("slides_get_error", err)
	}

	type slideContent struct {
		ObjectID    string   `j

func extractPageTexts(elements []*slides.PageElement) []string {
	var texts []string
	for _, elem := range elements {
		if elem.Shape == nil || elem.Shape.Text == nil {
			continue
		}
		for _, te := range elem.Shape.Text.TextElements {
			if te.TextRun != nil && te.TextRun.Content != "" {
				texts = append(texts, te.TextRun.Content)
			}
		}
	}
	return texts
}

func (c *SlidesWriteCmd) Run(ctx context.Context, root *RootFlags) error {
	if err := enforceActionPolicy(c.Account, "slides.write"); err != nil {
		return output.WriteError(output.ExitCodePermission, "policy_denied", err.Error())
	}

	if !root.DryRun && !c.ConfirmWrite {
		return output.WriteError(output.ExitCodeError, "write_requires_confirmation",
			"slides write requires --confirm-write")
	}

	if !root.DryRun {
		required, err := actionRequiresApproval("slides.write")
		if err != nil {
			return output.WriteError(output.ExitCodeError, "policy_error", err.Error())
		}
		if required {
			if err := consumeApprovalToken(c.Account, "slides.write", c.ApprovalToken); err != nil {
				return output.WriteError(output.ExitCodePermission, "approval_required", err.Error())
			}
		}
	}

	if root.DryRun {
		if err := appendAuditLog(root.AuditLog, auditEntry{
			Action:  "slides.write",
			Account: normalizeEmail(c.Account),
			Target:  c.PresentationID,
			DryRun:  true,
		}); err != nil {
			r

func slidesAuthError(err error) error {
	var authErr *googleapi.AuthRequiredError
	if isAuthErr(err, &authErr) {
		return output.WriteError(output.ExitCodeAuth, "auth_required", err.Error())
	}
	return output.WriteError(output.ExitCodeError, "slides_error", err.Error())
}

func readStdinWithLimit(limit int64) (string, error) {
	if limit <= 0 {
		return "", fmt.Errorf("invalid stdin limit: %d", limit)
	}

	limited := io.LimitReader(os.Stdin, limit+1)
	b, err := io.ReadAll(limited)
	if err != nil {
		return "", fmt.Errorf("read stdin: %w", err)
	}

	if int64(len(b)) > limit {
		return "", fmt.Errorf("stdin exceeds %d bytes", limit)
	}

	return string(b), nil
}

func Dir() (string, error) {
	base, err := os.UserConfigDir()
	if err != nil {
		return "", fmt.Errorf("resolve user config dir: %w", err)
	}

	return filepath.Join(base, AppName), nil
}

func EnsureDir() (string, error) {
	dir, err := Dir()
	if err != nil {
		return "", err
	}

	if err := os.MkdirAll(dir, 0o700); err != nil {
		return "", fmt.Errorf("ensure config dir: %w", err)
	}

	return dir, nil
}

func KeyringDir() (string, error) {
	dir, err := Dir()
	if err != nil {
		return "", err
	}

	return filepath.Join(dir, "keyring"), nil
}

func EnsureKeyringDir() (string, error) {
	dir, err := KeyringDir()
	if err != nil {
		return "", err
	}

	if err := os.MkdirAll(dir, 0o700); err != nil {
		return "", fmt.Errorf("ensure keyring dir: %w", err)
	}

	return dir, nil
}

func ConfigPath() (string, error) {
	dir, err := Dir()
	if err != nil {
		return "", err
	}

	return filepath.Join(dir, "config.json"), nil
}

func ReadConfig() (File, error) {
	path, err := ConfigPath()
	if err != nil {
		return File{}, err
	}

	b, err := os.ReadFile(path) //nolint:gosec
	if err != nil {
		if os.IsNotExist(err) {
			return File{}, nil
		}

		return File{}, fmt.Errorf("read config: %w", err)
	}

	var cfg File
	if err := json.Unmarshal(b, &cfg); err != nil {
		return File{}, fmt.Errorf("parse config %s: %w", path, err)
	}

	return cfg, nil
}

func CredentialsPath() (string, error) {
	dir, err := Dir()
	if err != nil {
		return "", err
	}

	return filepath.Join(dir, "credentials.json"), nil
}

func ReadCredentials() (ClientCredentials, error) {
	clientID := strings.TrimSpace(os.Getenv(clientIDEnvVar))
	clientSecret := strings.TrimSpace(os.Getenv(clientSecretEnvVar))
	if clientID != "" && clientSecret != "" {
		return ClientCredentials{ClientID: clientID, ClientSecret: clientSecret}, nil
	}
	if creds, ok := readCredentialsFromKeychain(); ok {
		return creds, nil
	}

	path, err := CredentialsPath()
	if err != nil {
		return ClientCredentials{}, err
	}

	b, err := os.ReadFile(path) //nolint:gosec
	if err != nil {
		if os.IsNotExist(err) {
			return ClientCredentials{}, &CredentialsMissingError{Path: path, Cause: err}
		}

		return ClientCredentials{}, fmt.Errorf("read credentials: %w", err)
	}

	// Try parsing as a Google OAuth credentials file first.
	var gf googleCredentialsFile
	if err := json.Unmarshal(b, &gf); err == nil {
		var clientID, clientSecret string
		if gf.Installed != nil {
			clientID, clientSecret = gf.Installed.ClientID, gf.Installed.ClientSecret
		} else if 

func readCredentialsFromKeychain() (ClientCredentials, bool) {
	if currentGOOS != "darwin" {
		return ClientCredentials{}, false
	}

	clientID, err := lookupKeychainItem(clientIDEnvVar)
	if err != nil {
		return ClientCredentials{}, false
	}
	clientSecret, err := lookupKeychainItem(clientSecretEnvVar)
	if err != nil {
		return ClientCredentials{}, false
	}

	clientID = strings.TrimSpace(clientID)
	clientSecret = strings.TrimSpace(clientSecret)
	if clientID == "" || clientSecret == "" {
		return ClientCredentials{}, false
	}

	return ClientCredentials{ClientID: clientID, ClientSecret: clientSecret}, true
}

func defaultLookupKeychainItem(service string) (string, error) {
	user := strings.TrimSpace(os.Getenv("USER"))
	if user == "" {
		// Keep this as a soft failure so caller can continue fallback resolution.
		return "", fmt.Errorf("USER environment variable is empty")
	}

	cmd := exec.Command("security", "find-generic-password", "-a", user, "-s", service, "-w")
	out, err := cmd.Output()
	if err != nil {
		return "", err
	}

	return strings.TrimSpace(string(out)), nil
}

func WriteCredentials(c ClientCredentials) error {
	_, err := EnsureDir()
	if err != nil {
		return fmt.Errorf("ensure config dir: %w", err)
	}

	path, err := CredentialsPath()
	if err != nil {
		return err
	}

	b, err := json.MarshalIndent(c, "", "  ")
	if err != nil {
		return fmt.Errorf("encode credentials: %w", err)
	}

	b = append(b, '\n')
	tmp := path + ".tmp"

	if err := os.WriteFile(tmp, b, 0o600); err != nil {
		return fmt.Errorf("write credentials: %w", err)
	}

	if err := os.Rename(tmp, path); err != nil {
		return fmt.Errorf("commit credentials: %w", err)
	}

	return nil
}

func PolicyPath() (string, error) {
	dir, err := Dir()
	if err != nil {
		return "", err
	}

	return filepath.Join(dir, "policy.json"), nil
}

func ReadPolicy() (PolicyFile, error) {
	path, err := PolicyPath()
	if err != nil {
		return PolicyFile{}, err
	}

	b, err := os.ReadFile(path) //nolint:gosec
	if err != nil {
		if os.IsNotExist(err) {
			return PolicyFile{}, nil
		}

		return PolicyFile{}, fmt.Errorf("read policy: %w", err)
	}

	var p PolicyFile
	if err := json.Unmarshal(b, &p); err != nil {
		return PolicyFile{}, fmt.Errorf("decode policy: %w", err)
	}

	p.normalize()

	return p, nil
}

func WritePolicy(p PolicyFile) error {
	p.normalize()

	dir, err := EnsureDir()
	if err != nil {
		return fmt.Errorf("ensure config dir: %w", err)
	}

	path := filepath.Join(dir, "policy.json")
	b, err := json.MarshalIndent(p, "", "  ")
	if err != nil {
		return fmt.Errorf("encode policy: %w", err)
	}
	b = append(b, '\n')

	tmp := path + ".tmp"
	if err := os.WriteFile(tmp, b, 0o600); err != nil {
		return fmt.Errorf("write policy: %w", err)
	}
	if err := os.Rename(tmp, path); err != nil {
		return fmt.Errorf("commit policy: %w", err)
	}

	return nil
}

func normalizeUnique(in []string) []string {
	if len(in) == 0 {
		return nil
	}

	set := make(map[string]struct{}, len(in))
	for _, v := range in {
		v = strings.ToLower(strings.TrimSpace(v))
		if v != "" {
			set[v] = struct{}{}
		}
	}

	out := make([]string, 0, len(set))
	for v := range set {
		out = append(out, v)
	}
	sort.Strings(out)

	return out
}

func optionsForEmail(ctx context.Context, service googleauth.Service, email string) ([]option.ClientOption, error) {
	scopes, err := googleauth.Scopes(service)
	if err != nil {
		return nil, fmt.Errorf("resolve scopes: %w", err)
	}

	return optionsForEmailWithScopes(ctx, string(service), email, scopes)
}

func optionsForEmailWithScopes(
	ctx context.Context,
	serviceName string,
	email string,
	scopes []string,
) ([]option.ClientOption, error) {
	scopes = normalizeScopes(scopes)
	if len(scopes) == 0 {
		return nil, fmt.Errorf("no scopes configured for %s", serviceName)
	}

	creds, err := config.ReadCredentials()
	if err != nil {
		return nil, fmt.Errorf("read credentials: %w", err)
	}

	store, err := secrets.OpenDefault()
	if err != nil {
		return nil, fmt.Errorf("open secrets store: %w", err)
	}

	tok, err := store.GetToken(email)
	if err != nil {
		if errors.Is(err, keyring.ErrKeyNotFound) {
			return nil, &AuthRequiredError{Service: serviceName, Email: email, Cause: err}
		}

		return nil, fmt.Errorf("get token for %s: %w", email, err)
	}

	cfg := oauth2.Config{
		ClientID:     creds.ClientID,
		ClientSecret: creds.ClientSecret,
		Endpoint:     google.Endpoint,
		Scopes:       append([]string(nil), scopes...),
	}

	ctx = context.WithValue(ctx, oauth2.HTTPClient, &http.Client{Timeout:

func normalizeScopes(scopes []string) []string {
	out := make([]string, 0, len(scopes))
	for _, s := range scopes {
		s = strings.TrimSpace(s)
		if s != "" {
			out = append(out, s)
		}
	}

	return out
}

func NewGmailReadOnly(ctx context.Context, email string) (*gmail.Service, error) {
	opts, err := optionsForEmailWithScopes(ctx, string(googleauth.ServiceGmail), email, []string{scopeGmailReadonly})
	if err != nil {
		return nil, fmt.Errorf("gmail options: %w", err)
	}
	return gmail.NewService(ctx, opts...)
}

func NewGmailWrite(ctx context.Context, email string) (*gmail.Service, error) {
	opts, err := optionsForEmailWithScopes(ctx, string(googleauth.ServiceGmail), email, []string{scopeGmailCompose})
	if err != nil {
		return nil, fmt.Errorf("gmail options: %w", err)
	}
	return gmail.NewService(ctx, opts...)
}

func NewCalendarReadOnly(ctx context.Context, email string) (*calendar.Service, error) {
	opts, err := optionsForEmailWithScopes(ctx, string(googleauth.ServiceCalendar), email, []string{scopeCalendarReadonly})
	if err != nil {
		return nil, fmt.Errorf("calendar options: %w", err)
	}
	return calendar.NewService(ctx, opts...)
}

func NewCalendarWrite(ctx context.Context, email string) (*calendar.Service, error) {
	opts, err := optionsForEmailWithScopes(ctx, string(googleauth.ServiceCalendar), email, []string{scopeCalendarWrite})
	if err != nil {
		return nil, fmt.Errorf("calendar options: %w", err)
	}
	return calendar.NewService(ctx, opts...)
}

func NewDocsReadOnly(ctx context.Context, email string) (*docs.Service, error) {
	opts, err := optionsForEmailWithScopes(ctx, string(googleauth.ServiceDocs), email, []string{scopeDocsReadonly})
	if err != nil {
		return nil, fmt.Errorf("docs options: %w", err)
	}
	return docs.NewService(ctx, opts...)
}

func NewDocsWrite(ctx context.Context, email string) (*docs.Service, error) {
	opts, err := optionsForEmailWithScopes(ctx, string(googleauth.ServiceDocs), email, []string{scopeDocsWrite})
	if err != nil {
		return nil, fmt.Errorf("docs options: %w", err)
	}
	return docs.NewService(ctx, opts...)
}

func NewDriveReadOnly(ctx context.Context, email string) (*drive.Service, error) {
	opts, err := optionsForEmailWithScopes(ctx, string(googleauth.ServiceDocs), email, []string{scopeDriveReadonly})
	if err != nil {
		return nil, fmt.Errorf("drive options: %w", err)
	}
	return drive.NewService(ctx, opts...)
}

func NewSheetsReadOnly(ctx context.Context, email string) (*sheets.Service, error) {
	opts, err := optionsForEmailWithScopes(ctx, string(googleauth.ServiceSheets), email, []string{scopeSheetsReadonly})
	if err != nil {
		return nil, fmt.Errorf("sheets options: %w", err)
	}
	return sheets.NewService(ctx, opts...)
}

func NewSheetsWrite(ctx context.Context, email string) (*sheets.Service, error) {
	opts, err := optionsForEmailWithScopes(ctx, string(googleauth.ServiceSheets), email, []string{scopeSheetsWrite})
	if err != nil {
		return nil, fmt.Errorf("sheets options: %w", err)
	}
	return sheets.NewService(ctx, opts...)
}

func NewSlidesReadOnly(ctx context.Context, email string) (*slides.Service, error) {
	opts, err := optionsForEmailWithScopes(ctx, string(googleauth.ServiceSlides), email, []string{scopeSlidesReadonly})
	if err != nil {
		return nil, fmt.Errorf("slides options: %w", err)
	}
	return slides.NewService(ctx, opts...)
}

func NewSlidesWrite(ctx context.Context, email string) (*slides.Service, error) {
	opts, err := optionsForEmailWithScopes(ctx, string(googleauth.ServiceSlides), email, []string{scopeSlidesWrite})
	if err != nil {
		return nil, fmt.Errorf("slides options: %w", err)
	}
	return slides.NewService(ctx, opts...)
}

func NewRetryTransport(base http.RoundTripper) *RetryTransport {
	if base == nil {
		base = http.DefaultTransport
	}

	return &RetryTransport{
		Base:          base,
		MaxRetries429: maxRetries429,
		MaxRetries5xx: maxRetries5xx,
		BaseDelay:     rateLimitBaseDelay,
	}
}

func (t *RetryTransport) RoundTrip(req *http.Request) (*http.Response, error) {
	if err := ensureReplayableBody(req); err != nil {
		return nil, err
	}

	retries429 := 0
	retries5xx := 0

	for {
		if req.GetBody != nil {
			if req.Body != nil {
				_ = req.Body.Close()
			}

			body, getErr := req.GetBody()
			if getErr != nil {
				return nil, fmt.Errorf("reset request body: %w", getErr)
			}

			req.Body = body
		}

		resp, err := t.Base.RoundTrip(req)
		if err != nil {
			return nil, fmt.Errorf("round trip: %w", err)
		}

		if resp.StatusCode < 400 {
			return resp, nil
		}

		if resp.StatusCode == http.StatusTooManyRequests {
			if retries429 >= t.MaxRetries429 {
				return resp, nil
			}

			delay := t.calculateBackoff(retries429, resp)
			drainAndClose(resp.Body)

			if err := t.sleep(req.Context(), delay); err != nil {
				return nil, err
			}

			retries429++

			continue
		}

		if resp.StatusCode >= 500 {
			if retries5xx >= t.MaxRetries5xx {
				return resp, nil
			}

			drai

func (t *RetryTransport) calculateBackoff(attempt int, resp *http.Response) time.Duration {
	if retryAfter := resp.Header.Get("Retry-After"); retryAfter != "" {
		if seconds, err := strconv.Atoi(retryAfter); err == nil {
			if seconds < 0 {
				return 0
			}

			return time.Duration(seconds) * time.Second
		}

		if parsed, err := http.ParseTime(retryAfter); err == nil {
			d := time.Until(parsed)
			if d < 0 {
				return 0
			}

			return d
		}
	}

	if t.BaseDelay <= 0 {
		return 0
	}

	baseDelay := t.BaseDelay * time.Duration(1<<attempt)
	if baseDelay <= 0 {
		return 0
	}

	jitterRange := baseDelay / 2
	if jitterRange <= 0 {
		return baseDelay
	}

	jitter := time.Duration(rand.Int64N(int64(jitterRange))) //nolint:gosec

	return baseDelay + jitter
}