[kartojal]

Adds the callback-owned AuthenticatedServiceClient transport on top of the current #442 retry policy. Authentication headers are resolved per attempt; 401 recovery can replay once, excluding authentication endpoints. The transport owns no credentials and preserves serialized bodies, cancellation and per-attempt timeouts.

Workflow GET requests retain their non-retrying transport policy. Restacked the final four-file transport change onto latest #442 instead of replaying superseded intermediate implementations. Bearer credential and session policy remain in #437.

Stack: #442 → #481 → #437 → #463 → #438 → #441.

Restacked on 2026-11-02 with the current retry/transport ancestry and #463 Gateway routing corrections. Existing plain bearer credentials, automatic migration and signer-only restoration are retained.

Combined stack validation on 2026-11-02: build, lint, workspace typecheck, browser bundle check, 415 bindings tests and 1,141 client tests passed (1,556 total, no type errors). No live authentication or financial operations were performed.

Gateway heartbeat compatibility remains blocked as documented in #463. Human approval and outstanding review threads have not been resolved automatically.

---

Note

Medium Risk
Touches core HTTP/auth transport (401 handling, refresh, replay, timeouts); wrong edge-case behavior could affect sessions or duplicate sensitive calls, though scope is a new experimental class with dedicated tests.

Overview
Introduces AuthenticatedServiceClient, an experimental transport that never stores credentials: callers supply resolveHeaders and refreshToken, and the client runs up to two HTTP attempts—after a 401 it may call refreshToken once and replay the same URL, body, and query string (with headers re-resolved), but /v1/auth/* does not get that recovery loop.

Timeout and cancellation: per-request HTTP timeouts apply only to actual fetch attempts, not to header resolution or refresh; abort cancels stalled callbacks without a late replay.

Retries: existing get / postRead read-retry behavior is preserved; getWorkflow paths like /command and /v1/auth/session still do not use read retries; timeouts do not consume the read retry budget.

Also adds a minor changeset for @polymarket/client and Vitest coverage for the behaviors above (including raw JSON body preservation and non-recursive refresh).

packages/client/src/index.ts re-exports the new client and config types (type-only, consistent with ServiceClient).

^{Reviewed by Cursor Bugbot for commit 1325104. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 976b162. Configure here.}