@chrischall/mcp-utils 2.11.0 → 2.13.0

package/dist/graphql/client.d.ts

@@ -0,0 +1,228 @@
+/**
+ * `createGraphqlClient` — the GraphQL-over-HTTP POST transport.
+ *
+ * Consolidates the hand-rolled GraphQL clients in vibo-mcp (`src/client.ts`
+ * `ViboClient.post` / `readGraphQLBody` / `unwrap` / `transportError`, the
+ * reference implementation) and thumbtack-mcp (`src/client.ts`
+ * `ThumbtackClient.graphql`) — chrischall/fleet-audit#1138, #1128. Both POST
+ * `{ query, variables }`, treat `errors[]` on an HTTP 200 as a failure, join
+ * and truncate the messages, and refuse a non-JSON 2xx as a challenge page;
+ * vibo adds auth-code classification, a refresh-and-replay-once, CDN/WAF
+ * detection, a timeout plus the caller's cancellation, and a write-aware
+ * transport error.
+ *
+ * It composes the `http` module's pieces rather than re-deriving them:
+ * {@link detectEdgeBlock} / {@link EdgeBlockedError} for refusals in front of
+ * the API, {@link RetryPolicy} and `parseRetryAfterMs` for 429s,
+ * {@link UnauthorizedError} / {@link RateLimitedError} /
+ * {@link UpstreamHttpError} for the statuses `createApiClient` already names,
+ * `formatApiError` / `truncateErrorMessage` so no upstream body or message
+ * reaches a tool result unredacted, and `withAmbientCancellation` so a
+ * cancelled tool call stops its request.
+ *
+ * It is not built ON `createApiClient` because a GraphQL server's error
+ * answer is a JSON body at whatever status (Apollo validation errors are a
+ * 400, vibo's permission denials a 403) and `fetchJson` turns every non-2xx
+ * into a message string, losing the `errors[]` this layer exists to read.
+ */
+import { McpToolError } from '../errors/index.js';
+import { type RateLimitContext, type RetryPolicy } from '../http/index.js';
+/** One entry of a GraphQL response's `errors[]`. */
+export interface GraphqlError {
+    message?: string;
+    /** Some servers (vibo) put the code at the top level… */
+    code?: string;
+    /** …the spec-blessed home is `extensions.code`. */
+    extensions?: {
+        code?: string;
+        [key: string]: unknown;
+    };
+    path?: ReadonlyArray<string | number>;
+    [key: string]: unknown;
+}
+/** A GraphQL request. */
+export interface GraphqlRequest {
+    /** The document. */
+    query: string;
+    /** Sent only when given. */
+    variables?: Record<string, unknown>;
+    /** Sent only when given. */
+    operationName?: string;
+    /** Extra headers for this request, merged over the client's. */
+    headers?: Record<string, string>;
+    /**
+     * Treat the request as safe to repeat even though the document contains a
+     * mutation — a sign-in or token refresh, say. It then gets a read's retry
+     * policy and a read's transport-error wording. Defaults to what
+     * {@link isReadOnlyGraphqlDocument} says about the document.
+     */
+    idempotent?: boolean;
+}
+/** What {@link GraphqlClient.execute} returns: the parsed envelope plus the HTTP status. */
+export interface GraphqlResult<T = unknown> {
+    status: number;
+    headers: Headers;
+    data?: T | null;
+    /** Normalized to an array of objects when present. */
+    errors?: GraphqlError[];
+    extensions?: Record<string, unknown>;
+}
+/** What {@link GraphqlClientOptions.mapError} is shown. */
+export interface GraphqlErrorContext {
+    status: number;
+    errors: readonly GraphqlError[];
+    data: unknown;
+}
+/** Options for {@link createGraphqlClient}. */
+export interface GraphqlClientOptions {
+    /** Absolute URL of the GraphQL endpoint. */
+    endpoint: string;
+    /** Human name of the upstream, used in messages. Defaults to the endpoint's host. */
+    serviceName?: string;
+    /**
+     * Headers sent on every request — a record, or a (possibly async) function
+     * re-read per request, which is where a rotating credential such as vibo's
+     * `x-token` belongs. A request's own `headers` override these.
+     */
+    headers?: Record<string, string> | (() => Record<string, string> | Promise<Record<string, string>>);
+    /**
+     * Per-attempt timeout in ms, from the request until the body is read.
+     * Defaults to 30 000 (both copies used 30 s); `0` disables it. The caller's
+     * cancellation applies either way.
+     */
+    timeout?: number;
+    /**
+     * 429 retry policy, as `createApiClient`'s: defaults to one retry after 2 s.
+     * Other `statuses` (transient 5xx) are retried only for a read-only or
+     * `idempotent` request — a 5xx on a mutation may have committed it. A 429
+     * is retried for a write too: a rate-limited request was refused, not run.
+     */
+    retry?: RetryPolicy;
+    /**
+     * Whether a response is an expired / missing session. Defaults to
+     * {@link isGraphqlAuthError}: HTTP 401, or an `UNAUTHENTICATED` /
+     * `UNAUTHORIZED` code. Never consulted for a CDN/WAF refusal.
+     */
+    isAuthError?: (status: number, errors: readonly GraphqlError[]) => boolean;
+    /**
+     * Re-authenticate after an auth failure (refresh the token, log in again).
+     * When set, the request is replayed ONCE with freshly read headers; a second
+     * auth failure throws. Single-flighting concurrent refreshes is the
+     * caller's job (a `TokenManager` or `createCachedTokenSource` does it).
+     */
+    onAuthError?: () => Promise<void> | void;
+    /** The error an unrecovered auth failure throws. Defaults to {@link UnauthorizedError}. */
+    onUnauthorized?: () => Error;
+    /**
+     * The error an exhausted 429 throws. Defaults to {@link RateLimitedError}.
+     * Receives the same {@link RateLimitContext} as `createApiClient`'s hook
+     * (`edgeBlock` is always `null` here: an edge-refused 429 has already thrown
+     * {@link EdgeBlockedError}). A zero-argument hook still works.
+     */
+    onRateLimited?: (ctx: RateLimitContext) => Error;
+    /**
+     * Claim a failed response before the default mapping — return an error to
+     * throw it, or `undefined` to fall through. Runs after any auth replay, on
+     * every response {@link GraphqlClient.request} would otherwise reject (and
+     * on none it would accept). The place for site rules such as vibo's
+     * "FORBIDDEN / HTTP 403 is a permission denial, not an expired session".
+     */
+    mapError?: (ctx: GraphqlErrorContext) => Error | undefined;
+    /** Hint attached to the {@link GraphqlResponseError} for an `errors[]` answer. */
+    errorHint?: string;
+    /**
+     * Hint for a write whose outcome is unknown (timed out / connection dropped
+     * after sending). Name the tool that checks the state.
+     */
+    writeOutcomeHint?: string;
+    /** Injectable fetch. Defaults to the global `fetch`. */
+    fetchImpl?: typeof fetch;
+    /** Injectable sleep for retries (tests). */
+    sleep?: (ms: number) => Promise<void>;
+}
+/** The client surface {@link createGraphqlClient} returns. */
+export interface GraphqlClient {
+    /**
+     * Send a request and return its parsed envelope, `errors[]` and all — for a
+     * raw passthrough tool that shows the caller what the server said. Still
+     * throws for everything that is not a GraphQL answer: a transport failure,
+     * a CDN/WAF refusal, an exhausted 429, or a body that is not a GraphQL
+     * response object (a non-JSON error page is an {@link UpstreamHttpError}).
+     * An auth failure is replayed once when `onAuthError` is set, then
+     * returned as-is.
+     */
+    execute<T = unknown>(request: GraphqlRequest): Promise<GraphqlResult<T>>;
+    /**
+     * Send a request and return its `data`, throwing for any failure: the
+     * `execute` failures, an auth failure ({@link UnauthorizedError} or
+     * `onUnauthorized`), `errors[]` ({@link GraphqlResponseError}, even beside
+     * partial data), a JSON non-2xx with no `errors[]`
+     * ({@link UpstreamHttpError}), or a response with no data.
+     */
+    request<T = unknown>(query: string, variables?: Record<string, unknown>, opts?: Omit<GraphqlRequest, 'query' | 'variables'>): Promise<T>;
+}
+/**
+ * The server answered, but with GraphQL `errors[]` (or with something that is
+ * not a GraphQL response at all — then `errors` is empty). The message joins
+ * the messages, redacted and truncated; the raw entries, any partial `data`,
+ * and the codes ride along for callers that branch.
+ */
+export declare class GraphqlResponseError extends McpToolError {
+    readonly status: number;
+    readonly errors: readonly GraphqlError[];
+    readonly data: unknown;
+    /** Every `code` / `extensions.code` present, in order. */
+    readonly codes: readonly string[];
+    constructor(message: string, details: {
+        status: number;
+        errors?: readonly GraphqlError[];
+        data?: unknown;
+        hint?: string;
+    });
+}
+/**
+ * The request never produced a response: it timed out, or the connection
+ * failed. For a read that is safe to retry. For a write the outcome is
+ * UNKNOWN — the server may already have committed it — so `outcomeUnknown` is
+ * set, the message says so, and the hint asks for a state check before any
+ * retry (a confirmation gate cannot stop a blind retry: a fresh preview earns
+ * a fresh approval). A caller's cancellation is not this error; its abort is
+ * rethrown untouched.
+ */
+export declare class GraphqlTransportError extends McpToolError {
+    readonly timedOut: boolean;
+    readonly outcomeUnknown: boolean;
+    constructor(message: string, details: {
+        timedOut: boolean;
+        outcomeUnknown: boolean;
+        hint: string;
+        cause: unknown;
+    });
+}
+/** The error code of one `errors[]` entry: top-level `code`, else `extensions.code`. */
+export declare function graphqlErrorCode(error: GraphqlError): string | undefined;
+/**
+ * The default expired-session test: HTTP 401, or an `UNAUTHENTICATED` /
+ * `UNAUTHORIZED` code. `FORBIDDEN` is deliberately not one — it is a
+ * permission denial, and refreshing a token cannot fix it.
+ */
+export declare function isGraphqlAuthError(status: number, errors: readonly GraphqlError[]): boolean;
+/**
+ * Build a GraphQL-over-HTTP client: POST `{ query, variables?, operationName? }`
+ * as JSON, read `errors[]` at any status, and map every other outcome onto the
+ * package's existing error types. See {@link GraphqlClient} for what each
+ * method throws and {@link GraphqlClientOptions} for the hooks.
+ *
+ * ```ts
+ * const gql = createGraphqlClient({
+ *   endpoint: 'https://api.vibodj.com/v2/graphql',
+ *   serviceName: 'Vibo',
+ *   headers: async () => ({ 'x-token': await tokens.current() }),
+ *   onAuthError: () => tokens.refresh(),
+ *   onUnauthorized: () => new SessionNotAuthenticatedError('Vibo', 'https://web.vibodj.com'),
+ * });
+ * const { me } = await gql.request<{ me: { id: string } }>('query Me { me { id } }');
+ * ```
+ */
+export declare function createGraphqlClient(opts: GraphqlClientOptions): GraphqlClient;
+//# sourceMappingURL=client.d.ts.map

package/dist/graphql/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/graphql/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,EAAE,YAAY,EAAmC,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAQL,KAAK,gBAAgB,EACrB,KAAK,WAAW,EACjB,MAAM,kBAAkB,CAAC;AAI1B,oDAAoD;AACpD,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,UAAU,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACvD,IAAI,CAAC,EAAE,aAAa,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;IACtC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,yBAAyB;AACzB,MAAM,WAAW,cAAc;IAC7B,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,4BAA4B;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,4BAA4B;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,4FAA4F;AAC5F,MAAM,WAAW,aAAa,CAAC,CAAC,GAAG,OAAO;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC;IAChB,sDAAsD;IACtD,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,2DAA2D;AAC3D,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,YAAY,EAAE,CAAC;IAChC,IAAI,EAAE,OAAO,CAAC;CACf;AAED,+CAA+C;AAC/C,MAAM,WAAW,oBAAoB;IACnC,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,qFAAqF;IACrF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACpG;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,YAAY,EAAE,KAAK,OAAO,CAAC;IAC3E;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACzC,2FAA2F;IAC3F,cAAc,CAAC,EAAE,MAAM,KAAK,CAAC;IAC7B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,mBAAmB,KAAK,KAAK,GAAG,SAAS,CAAC;IAC3D,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wDAAwD;IACxD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,4CAA4C;IAC5C,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,8DAA8D;AAC9D,MAAM,WAAW,aAAa;IAC5B;;;;;;;;OAQG;IACH,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE;;;;;;OAMG;IACH,OAAO,CAAC,CAAC,GAAG,OAAO,EACjB,KAAK,EAAE,MAAM,EACb,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACnC,IAAI,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,GAAG,WAAW,CAAC,GACjD,OAAO,CAAC,CAAC,CAAC,CAAC;CACf;AAED;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,YAAY;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAElC,YACE,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAQ7F;CACF;AAED;;;;;;;;GAQG;AACH,qBAAa,qBAAsB,SAAQ,YAAY;IACrD,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IAEjC,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,cAAc,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,EAKjH;CACF;AAED,wFAAwF;AACxF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,GAAG,SAAS,CAGxE;AAID;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,YAAY,EAAE,GAAG,OAAO,CAM3F;AA6DD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,oBAAoB,GAAG,aAAa,CAgL7E"}

package/dist/graphql/client.js

@@ -0,0 +1,341 @@
+/**
+ * `createGraphqlClient` — the GraphQL-over-HTTP POST transport.
+ *
+ * Consolidates the hand-rolled GraphQL clients in vibo-mcp (`src/client.ts`
+ * `ViboClient.post` / `readGraphQLBody` / `unwrap` / `transportError`, the
+ * reference implementation) and thumbtack-mcp (`src/client.ts`
+ * `ThumbtackClient.graphql`) — chrischall/fleet-audit#1138, #1128. Both POST
+ * `{ query, variables }`, treat `errors[]` on an HTTP 200 as a failure, join
+ * and truncate the messages, and refuse a non-JSON 2xx as a challenge page;
+ * vibo adds auth-code classification, a refresh-and-replay-once, CDN/WAF
+ * detection, a timeout plus the caller's cancellation, and a write-aware
+ * transport error.
+ *
+ * It composes the `http` module's pieces rather than re-deriving them:
+ * {@link detectEdgeBlock} / {@link EdgeBlockedError} for refusals in front of
+ * the API, {@link RetryPolicy} and `parseRetryAfterMs` for 429s,
+ * {@link UnauthorizedError} / {@link RateLimitedError} /
+ * {@link UpstreamHttpError} for the statuses `createApiClient` already names,
+ * `formatApiError` / `truncateErrorMessage` so no upstream body or message
+ * reaches a tool result unredacted, and `withAmbientCancellation` so a
+ * cancelled tool call stops its request.
+ *
+ * It is not built ON `createApiClient` because a GraphQL server's error
+ * answer is a JSON body at whatever status (Apollo validation errors are a
+ * 400, vibo's permission denials a 403) and `fetchJson` turns every non-2xx
+ * into a message string, losing the `errors[]` this layer exists to read.
+ */
+import { withAmbientCancellation } from '../cancel/index.js';
+import { McpToolError, messageOf, truncateErrorMessage } from '../errors/index.js';
+import { EdgeBlockedError, RateLimitedError, UnauthorizedError, UpstreamHttpError, detectEdgeBlock, formatApiError, parseRetryAfterMs, } from '../http/index.js';
+import { retryAfterToMs } from '../internal/retry-after.js';
+import { isReadOnlyGraphqlDocument } from './operation-kind.js';
+/**
+ * The server answered, but with GraphQL `errors[]` (or with something that is
+ * not a GraphQL response at all — then `errors` is empty). The message joins
+ * the messages, redacted and truncated; the raw entries, any partial `data`,
+ * and the codes ride along for callers that branch.
+ */
+export class GraphqlResponseError extends McpToolError {
+    status;
+    errors;
+    data;
+    /** Every `code` / `extensions.code` present, in order. */
+    codes;
+    constructor(message, details) {
+        super(message, details.hint !== undefined ? { hint: details.hint } : undefined);
+        this.name = 'GraphqlResponseError';
+        this.status = details.status;
+        this.errors = details.errors ?? [];
+        this.data = details.data;
+        this.codes = this.errors.map(graphqlErrorCode).filter((c) => c !== undefined);
+    }
+}
+/**
+ * The request never produced a response: it timed out, or the connection
+ * failed. For a read that is safe to retry. For a write the outcome is
+ * UNKNOWN — the server may already have committed it — so `outcomeUnknown` is
+ * set, the message says so, and the hint asks for a state check before any
+ * retry (a confirmation gate cannot stop a blind retry: a fresh preview earns
+ * a fresh approval). A caller's cancellation is not this error; its abort is
+ * rethrown untouched.
+ */
+export class GraphqlTransportError extends McpToolError {
+    timedOut;
+    outcomeUnknown;
+    constructor(message, details) {
+        super(message, { hint: details.hint, cause: details.cause });
+        this.name = 'GraphqlTransportError';
+        this.timedOut = details.timedOut;
+        this.outcomeUnknown = details.outcomeUnknown;
+    }
+}
+/** The error code of one `errors[]` entry: top-level `code`, else `extensions.code`. */
+export function graphqlErrorCode(error) {
+    const code = error.code ?? error.extensions?.code;
+    return typeof code === 'string' ? code : undefined;
+}
+const AUTH_CODES = new Set(['UNAUTHENTICATED', 'UNAUTHORIZED']);
+/**
+ * The default expired-session test: HTTP 401, or an `UNAUTHENTICATED` /
+ * `UNAUTHORIZED` code. `FORBIDDEN` is deliberately not one — it is a
+ * permission denial, and refreshing a token cannot fix it.
+ */
+export function isGraphqlAuthError(status, errors) {
+    if (status === 401)
+        return true;
+    return errors.some((e) => {
+        const code = graphqlErrorCode(e);
+        return code !== undefined && AUTH_CODES.has(code);
+    });
+}
+const DEFAULT_TIMEOUT_MS = 30_000;
+const DEFAULT_RETRY = { count: 1, delayMs: 2000 };
+const defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
+/** Thrown internally when our own timer fired. */
+class TimedOut extends Error {
+}
+function objectOf(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+/** `errors` as an array of objects, whatever shape the server sent. */
+function normalizeErrors(raw) {
+    if (raw === undefined || raw === null)
+        return undefined;
+    const list = Array.isArray(raw) ? raw : [raw];
+    return list.map((e) => {
+        const obj = objectOf(e);
+        if (obj)
+            return obj;
+        return { message: typeof e === 'string' ? e : String(e) };
+    });
+}
+/** Parse a body into a GraphQL envelope, or `undefined` when it is not one. */
+function parseEnvelope(text) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+    const obj = objectOf(parsed);
+    if (!obj)
+        return undefined;
+    const errors = normalizeErrors(obj.errors);
+    const extensions = objectOf(obj.extensions);
+    return {
+        ...('data' in obj ? { data: obj.data } : {}),
+        ...(errors !== undefined ? { errors } : {}),
+        ...(extensions !== undefined ? { extensions } : {}),
+    };
+}
+function hostOf(url) {
+    try {
+        return new URL(url).host;
+    }
+    catch {
+        return url;
+    }
+}
+function pathOf(url) {
+    try {
+        return new URL(url).pathname;
+    }
+    catch {
+        return url;
+    }
+}
+/**
+ * Build a GraphQL-over-HTTP client: POST `{ query, variables?, operationName? }`
+ * as JSON, read `errors[]` at any status, and map every other outcome onto the
+ * package's existing error types. See {@link GraphqlClient} for what each
+ * method throws and {@link GraphqlClientOptions} for the hooks.
+ *
+ * ```ts
+ * const gql = createGraphqlClient({
+ *   endpoint: 'https://api.vibodj.com/v2/graphql',
+ *   serviceName: 'Vibo',
+ *   headers: async () => ({ 'x-token': await tokens.current() }),
+ *   onAuthError: () => tokens.refresh(),
+ *   onUnauthorized: () => new SessionNotAuthenticatedError('Vibo', 'https://web.vibodj.com'),
+ * });
+ * const { me } = await gql.request<{ me: { id: string } }>('query Me { me { id } }');
+ * ```
+ */
+export function createGraphqlClient(opts) {
+    const service = opts.serviceName ?? hostOf(opts.endpoint);
+    const path = pathOf(opts.endpoint);
+    const doFetch = opts.fetchImpl ?? fetch;
+    const sleep = opts.sleep ?? defaultSleep;
+    const timeoutMs = opts.timeout ?? DEFAULT_TIMEOUT_MS;
+    const retry = opts.retry ?? DEFAULT_RETRY;
+    const retryStatuses = retry.statuses ?? [429];
+    const isAuth = opts.isAuthError ?? isGraphqlAuthError;
+    async function headersFor(req) {
+        const base = typeof opts.headers === 'function' ? await opts.headers() : (opts.headers ?? {});
+        return { 'content-type': 'application/json', accept: 'application/json', ...base, ...req.headers };
+    }
+    /**
+     * One HTTP attempt, bounded from the request until the body has been read.
+     * The read is RACED against the timer rather than trusting the body stream
+     * to honour the abort, so a `fetchImpl` that ignores the signal is bounded
+     * too.
+     */
+    async function attempt(init) {
+        const controller = timeoutMs > 0 ? new AbortController() : undefined;
+        let timer;
+        let expired;
+        if (controller) {
+            expired = new Promise((_resolve, reject) => {
+                controller.signal.addEventListener('abort', () => reject(new TimedOut()), { once: true });
+            });
+            expired.catch(() => { });
+            timer = setTimeout(() => controller.abort(), timeoutMs);
+        }
+        const signal = withAmbientCancellation(controller?.signal);
+        const work = (async () => {
+            const res = await doFetch(opts.endpoint, { ...init, ...(signal ? { signal } : {}) });
+            return { res, text: await res.text() };
+        })();
+        work.catch(() => { });
+        try {
+            return await (expired ? Promise.race([work, expired]) : work);
+        }
+        catch (err) {
+            // Told apart by WHICH signal fired: an abort is an `AbortError` whichever
+            // end caused it, and a caller's cancellation is not this service timing out.
+            if (controller?.signal.aborted)
+                throw new TimedOut();
+            throw err;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    function transportError(err, timedOut, write) {
+        const what = timedOut
+            ? `Request to ${service} timed out after ${timeoutMs}ms`
+            : `Request to ${service} failed: ${truncateErrorMessage(messageOf(err), 200)}`;
+        if (write) {
+            return new GraphqlTransportError(`${what} — the change may already have been applied (outcome is unknown).`, {
+                timedOut,
+                outcomeUnknown: true,
+                hint: opts.writeOutcomeHint ??
+                    'Do not repeat this write blindly — check the current state first, and retry only if the change is not there.',
+                cause: err,
+            });
+        }
+        return new GraphqlTransportError(`${what}.`, {
+            timedOut,
+            outcomeUnknown: false,
+            hint: `The ${service} API may be slow or unreachable — check your connection and retry.`,
+            cause: err,
+        });
+    }
+    /** Send with the retry policy; returns the final response and its body. */
+    async function send(req, write) {
+        const body = JSON.stringify({
+            query: req.query,
+            ...(req.variables !== undefined ? { variables: req.variables } : {}),
+            ...(req.operationName !== undefined ? { operationName: req.operationName } : {}),
+        });
+        for (let tries = 0;; tries++) {
+            let sent;
+            try {
+                sent = await attempt({ method: 'POST', headers: await headersFor(req), body });
+            }
+            catch (err) {
+                if (err instanceof TimedOut)
+                    throw transportError(err, true, write);
+                if (err instanceof Error && err.name === 'AbortError')
+                    throw err; // the caller cancelled
+                throw transportError(err, false, write);
+            }
+            const status = sent.res.status;
+            const retryable = retryStatuses.includes(status) && (status === 429 || !write);
+            if (retryable && tries < retry.count) {
+                const delay = retry.honorRetryAfter
+                    ? parseRetryAfterMs(sent.res.headers.get('retry-after'), {
+                        defaultMs: retry.delayMs,
+                        capMs: retry.maxRetryAfterMs ?? 30_000,
+                    })
+                    : retry.delayMs;
+                await sleep(delay);
+                continue;
+            }
+            return sent;
+        }
+    }
+    async function execute(req) {
+        const write = req.idempotent === true ? false : !isReadOnlyGraphqlDocument(req.query);
+        for (let replayed = false;; replayed = true) {
+            const { res, text } = await send(req, write);
+            const status = res.status;
+            if (status >= 400) {
+                const edge = detectEdgeBlock({ body: text, headers: res.headers, status });
+                if (edge)
+                    throw new EdgeBlockedError(status, edge.vendor, { service, method: 'POST', path });
+            }
+            if (status === 429) {
+                const retryAfter = res.headers.get('retry-after');
+                const retryAfterMs = retryAfterToMs(retryAfter);
+                throw opts.onRateLimited
+                    ? opts.onRateLimited({ status, retryAfter, retryAfterMs, edgeBlock: null, method: 'POST', path })
+                    : new RateLimitedError(service, retryAfterMs);
+            }
+            const envelope = parseEnvelope(text);
+            if (envelope === undefined) {
+                if (status >= 400 && status !== 401) {
+                    throw new UpstreamHttpError(status, formatApiError(status, 'POST', path, text, { service }));
+                }
+                if (status < 400) {
+                    const edge = detectEdgeBlock({ body: text, headers: res.headers, status });
+                    if (edge)
+                        throw new EdgeBlockedError(status, edge.vendor, { service, method: 'POST', path });
+                    throw new GraphqlResponseError(text.trim().length === 0
+                        ? `${service} GraphQL API returned an empty response (HTTP ${status}).`
+                        : `${service} GraphQL API returned a non-JSON body (HTTP ${status}) — this is usually a challenge or error page, not data.`, { status, hint: 'Retry shortly. If it persists, the endpoint or its request shape has changed.' });
+                }
+            }
+            const result = { status, headers: res.headers, ...envelope };
+            if (!replayed && opts.onAuthError && isAuth(status, result.errors ?? [])) {
+                await opts.onAuthError();
+                continue;
+            }
+            return result;
+        }
+    }
+    async function request(query, variables, more = {}) {
+        const result = await execute({ ...more, query, ...(variables !== undefined ? { variables } : {}) });
+        const { status, data } = result;
+        const errors = result.errors ?? [];
+        const failed = errors.length > 0 || status >= 400 || data === undefined || data === null;
+        if (failed && opts.mapError) {
+            const mapped = opts.mapError({ status, errors, data });
+            if (mapped)
+                throw mapped;
+        }
+        if (isAuth(status, errors))
+            throw opts.onUnauthorized ? opts.onUnauthorized() : new UnauthorizedError(service);
+        if (errors.length > 0) {
+            const detail = errors.map((e) => (typeof e.message === 'string' && e.message ? e.message : 'Unknown error')).join('; ');
+            throw new GraphqlResponseError(`${service} GraphQL error: ${truncateErrorMessage(detail)}`, {
+                status,
+                errors,
+                data,
+                ...(opts.errorHint !== undefined ? { hint: opts.errorHint } : {}),
+            });
+        }
+        if (status >= 400)
+            throw new UpstreamHttpError(status, `${service} GraphQL API returned HTTP ${status}.`);
+        if (data === undefined || data === null) {
+            throw new GraphqlResponseError(`${service} GraphQL API returned an empty response.`, { status });
+        }
+        return data;
+    }
+    return { execute, request };
+}
+//# sourceMappingURL=client.js.map

package/dist/graphql/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/graphql/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,iBAAiB,GAGlB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AA+IhE;;;;;GAKG;AACH,MAAM,OAAO,oBAAqB,SAAQ,YAAY;IAC3C,MAAM,CAAS;IACf,MAAM,CAA0B;IAChC,IAAI,CAAU;IACvB,0DAA0D;IACjD,KAAK,CAAoB;IAElC,YACE,OAAe,EACf,OAA4F;QAE5F,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAChF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IAC7F,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,qBAAsB,SAAQ,YAAY;IAC5C,QAAQ,CAAU;IAClB,cAAc,CAAU;IAEjC,YAAY,OAAe,EAAE,OAAqF;QAChH,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;IAC/C,CAAC;CACF;AAED,wFAAwF;AACxF,MAAM,UAAU,gBAAgB,CAAC,KAAmB;IAClD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC;IAClD,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC,CAAC;AAEhE;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,MAA+B;IAChF,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACjC,OAAO,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,aAAa,GAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC/D,MAAM,YAAY,GAAG,CAAC,EAAU,EAAiB,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAE1F,kDAAkD;AAClD,MAAM,QAAS,SAAQ,KAAK;CAAG;AAE/B,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,uEAAuE;AACvE,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC9C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAgB,EAAE;QAClC,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,GAAG;YAAE,OAAO,GAAmB,CAAC;QACpC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC5C,OAAO;QACL,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,GAAW;IACzB,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,GAAW;IACzB,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAA0B;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,IAAI,kBAAkB,CAAC;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC;IAC1C,MAAM,aAAa,GAAG,KAAK,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC;IAEtD,KAAK,UAAU,UAAU,CAAC,GAAmB;QAC3C,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC9F,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IACrG,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,OAAO,CAAC,IAAiB;QACtC,MAAM,UAAU,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,IAAI,KAAgD,CAAC;QACrD,IAAI,OAAmC,CAAC;QACxC,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;gBAChD,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5F,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACxB,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,MAAM,GAAG,uBAAuB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE;YACvB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACrF,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QACzC,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0EAA0E;YAC1E,6EAA6E;YAC7E,IAAI,UAAU,EAAE,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,QAAQ,EAAE,CAAC;YACrD,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,SAAS,cAAc,CAAC,GAAY,EAAE,QAAiB,EAAE,KAAc;QACrE,MAAM,IAAI,GAAG,QAAQ;YACnB,CAAC,CAAC,cAAc,OAAO,oBAAoB,SAAS,IAAI;YACxD,CAAC,CAAC,cAAc,OAAO,YAAY,oBAAoB,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QACjF,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,IAAI,qBAAqB,CAAC,GAAG,IAAI,mEAAmE,EAAE;gBAC3G,QAAQ;gBACR,cAAc,EAAE,IAAI;gBACpB,IAAI,EACF,IAAI,CAAC,gBAAgB;oBACrB,8GAA8G;gBAChH,KAAK,EAAE,GAAG;aACX,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,qBAAqB,CAAC,GAAG,IAAI,GAAG,EAAE;YAC3C,QAAQ;YACR,cAAc,EAAE,KAAK;YACrB,IAAI,EAAE,OAAO,OAAO,oEAAoE;YACxF,KAAK,EAAE,GAAG;SACX,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,KAAK,UAAU,IAAI,CAAC,GAAmB,EAAE,KAAc;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjF,CAAC,CAAC;QACH,KAAK,IAAI,KAAK,GAAG,CAAC,GAAI,KAAK,EAAE,EAAE,CAAC;YAC9B,IAAI,IAAqC,CAAC;YAC1C,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YACjF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,QAAQ;oBAAE,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;gBACpE,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY;oBAAE,MAAM,GAAG,CAAC,CAAC,uBAAuB;gBACzF,MAAM,cAAc,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;YAC1C,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;YAC/B,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/E,IAAI,SAAS,IAAI,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;gBACrC,MAAM,KAAK,GAAG,KAAK,CAAC,eAAe;oBACjC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE;wBACrD,SAAS,EAAE,KAAK,CAAC,OAAO;wBACxB,KAAK,EAAE,KAAK,CAAC,eAAe,IAAI,MAAM;qBACvC,CAAC;oBACJ,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;gBAClB,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,UAAU,OAAO,CAAc,GAAmB;QACrD,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtF,KAAK,IAAI,QAAQ,GAAG,KAAK,GAAI,QAAQ,GAAG,IAAI,EAAE,CAAC;YAC7C,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YAC1B,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;gBAClB,MAAM,IAAI,GAAG,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC3E,IAAI,IAAI;oBAAE,MAAM,IAAI,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/F,CAAC;YACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBACnB,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBAClD,MAAM,YAAY,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;gBAChD,MAAM,IAAI,CAAC,aAAa;oBACtB,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;oBACjG,CAAC,CAAC,IAAI,gBAAgB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;oBACpC,MAAM,IAAI,iBAAiB,CAAC,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;gBAC/F,CAAC;gBACD,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;oBACjB,MAAM,IAAI,GAAG,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;oBAC3E,IAAI,IAAI;wBAAE,MAAM,IAAI,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC7F,MAAM,IAAI,oBAAoB,CAC5B,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;wBACtB,CAAC,CAAC,GAAG,OAAO,iDAAiD,MAAM,IAAI;wBACvE,CAAC,CAAC,GAAG,OAAO,+CAA+C,MAAM,0DAA0D,EAC7H,EAAE,MAAM,EAAE,IAAI,EAAE,+EAA+E,EAAE,CAClG,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,MAAM,GAAqB,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAI,QAAyD,EAAE,CAAC;YACjI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;gBACzE,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;gBACzB,SAAS;YACX,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,KAAK,UAAU,OAAO,CACpB,KAAa,EACb,SAAmC,EACnC,IAAI,GAAgD,EAAE;QAEtD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAI,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACvG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,IAAI,GAAG,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,CAAC;QACzF,IAAI,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,IAAI,MAAM;gBAAE,MAAM,MAAM,CAAC;QAC3B,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;YAAE,MAAM,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC/G,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxH,MAAM,IAAI,oBAAoB,CAAC,GAAG,OAAO,mBAAmB,oBAAoB,CAAC,MAAM,CAAC,EAAE,EAAE;gBAC1F,MAAM;gBACN,MAAM;gBACN,IAAI;gBACJ,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClE,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,IAAI,GAAG;YAAE,MAAM,IAAI,iBAAiB,CAAC,MAAM,EAAE,GAAG,OAAO,8BAA8B,MAAM,GAAG,CAAC,CAAC;QAC1G,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,oBAAoB,CAAC,GAAG,OAAO,0CAA0C,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC"}

package/dist/graphql/index.d.ts

@@ -0,0 +1,20 @@
+/**
+ * `@chrischall/mcp-utils/graphql` — a GraphQL-over-HTTP transport and a
+ * GraphQL operation-kind lexer.
+ *
+ * Zero optional peers (it builds on the core `http`, `errors` and `cancel`
+ * modules only). It is a subpath rather than part of the core barrel for the
+ * same reason `/healthcheck` is: only the handful of GraphQL servers in the
+ * fleet need it.
+ *
+ *  - {@link createGraphqlClient} — POST `{ query, variables, operationName }`,
+ *    `errors[]` at any status, auth replay, CDN/WAF detection, timeout and
+ *    cancellation, write-aware transport errors (vibo-mcp / thumbtack-mcp,
+ *    chrischall/fleet-audit#1138, #1128).
+ *  - {@link graphqlOperationKinds} / {@link isReadOnlyGraphqlDocument} — is a
+ *    document a query, mutation or subscription (onehome-mcp / hemnet-mcp /
+ *    booli-mcp / vibo-mcp, chrischall/fleet-audit#1080, #988, #1020).
+ */
+export * from './client.js';
+export * from './operation-kind.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/graphql/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/graphql/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,cAAc,aAAa,CAAC;AAC5B,cAAc,qBAAqB,CAAC"}

package/dist/graphql/index.js

@@ -0,0 +1,20 @@
+/**
+ * `@chrischall/mcp-utils/graphql` — a GraphQL-over-HTTP transport and a
+ * GraphQL operation-kind lexer.
+ *
+ * Zero optional peers (it builds on the core `http`, `errors` and `cancel`
+ * modules only). It is a subpath rather than part of the core barrel for the
+ * same reason `/healthcheck` is: only the handful of GraphQL servers in the
+ * fleet need it.
+ *
+ *  - {@link createGraphqlClient} — POST `{ query, variables, operationName }`,
+ *    `errors[]` at any status, auth replay, CDN/WAF detection, timeout and
+ *    cancellation, write-aware transport errors (vibo-mcp / thumbtack-mcp,
+ *    chrischall/fleet-audit#1138, #1128).
+ *  - {@link graphqlOperationKinds} / {@link isReadOnlyGraphqlDocument} — is a
+ *    document a query, mutation or subscription (onehome-mcp / hemnet-mcp /
+ *    booli-mcp / vibo-mcp, chrischall/fleet-audit#1080, #988, #1020).
+ */
+export * from './client.js';
+export * from './operation-kind.js';
+//# sourceMappingURL=index.js.map

package/dist/graphql/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/graphql/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,cAAc,aAAa,CAAC;AAC5B,cAAc,qBAAqB,CAAC"}