feat: implement the URL search params serialization standard

[razor-x]

Implements the Seam URL search params serialization standard in Python and puts it to work, so each endpoint is called with its semantic method.

Serialization

A port of the reference implementation, producing byte-identical output:

• values encoded with the application/x-www-form-urlencoded serializer, which differs from urllib in its treatment of * and ~
• params sorted by name, compared by UTF-16 code unit, so 😀 sorts before �
• floats formatted with the ECMAScript Number::toString algorithm, which differs from repr for integral floats and around the exponent-notation thresholds

Verified against the reference implementation running under Node: 116 hand-built cases covering every rule in its README, 4,000 randomized nested-param cases, and 60,000 floats including every power of ten from 1e-330 to 1e308, denormals, and random binary64 bit patterns. All match. Separately, 22 cases round-trip through the parser the API uses in strict mode, which is documented as a true inverse of the serializer.

Omitted params and null params

The API distinguishes an omitted param from one explicitly set to null, and Python has a single absence value. Since sending null is rarely intended and unsetting a value cannot be undone, None keeps meaning omit and seam.NULL sends null. This adds the capability without changing the behavior of any existing call.

It also closes a gap: access_grants.list documents null as a filter for Access Grants with no access_grant_key, and passing None dropped the filter and returned every Access Grant.

Now that blueprint reports isNullable for request parameters, only the params the API documents as nullable accept NULL, and a type checker rejects it elsewhere:

seam.access_grants.list(access_grant_key=NULL)       # ok
seam.devices.update(device_id="d", is_managed=NULL)  # error: "Null" is not assignable to "bool | None"

Semantic methods

Route methods are generated against the endpoint's semanticMethod rather than its preferredMethod. The preferred method falls back to POST when an endpoint takes array or object params, because those had no unambiguous query string representation — which is what this serialization provides.

The 132 endpoints whose semantics are a GET now send params in the query string; every other method, DELETE included, reads them from a JSON body. Confirmed against the fake server, where a DELETE with its params in the query string reports the record as not found while the same params in a body succeed.

The query is set on the URL rather than handed to httpx as params, because httpx re-encodes a query string it is given: it escapes * and unescapes ~.

Retries

This settles the retries option. httpx-retries treats GET, PUT and DELETE as retryable and POST as not, so the option had no effect while every request was a POST. It now reaches API requests without the SDK exposing the HTTP method, so the xfail markers are removed from the two tests that recorded that.

Two consequences worth knowing

• A query string carries no types. A wrong-typed value is no longer rejected as invalid input when it can be read as the expected type: devices.get(device_id=4242) used to 400 because JSON preserved the int, and now reads as the id "4242" and reports not found. The test that covered this was retargeted at a missing required param, which still 400s.
• Retries now depend on an endpoint's verb. GET, PUT and DELETE endpoints retry under the default policy; POST and PATCH do not. Worth deciding whether DEFAULT_RETRIES should cover them so behavior does not vary by endpoint.

Also

@seamapi/types moves one release, to 1.984.0, the first that gives submit_args a type — blueprint 1.4.0 turns an untyped property from a warning into an error. It adds between to events.list. @seamapi/fake-seam-connect moves to 2.0.3, the first release carrying the parser.

One gap: custom_metadata_has object filtering is unverified end to end, because the fake server ignores both custom_metadata on update and that filter, identically over POST and GET. The wire format is covered by the parser round-trip.

Checks

154 tests pass, pylint 10.00/10, black, rstcheck, mypy seam test clean across 113 files, and codegen reruns with zero drift.