@foir/sdk 0.7.0 → 0.9.0

package/dist/auth.js

@@ -100,6 +100,13 @@ function buildFoirHeaders(input) {
   }
   return headers;
 }
+function foirApiEndpoint(apiUrl, path) {
+  const base = apiUrl.trim().replace(/\/+$/, "").replace(/\/graphql$/i, "");
+  if (!base) {
+    throw new FoirRequestError("[foir] apiUrl is empty \u2014 pass the Foir API origin");
+  }
+  return base + path;
+}
 function readFoirEnvelope(json) {
   if (json.errors?.length) {
     const msg = json.errors.map((e) => e.message).join("; ");
@@ -117,18 +124,14 @@ function readFoirEnvelope(json) {
   return json.data;
 }
 
-// src/graphql/cdn-route.ts
-var CDN_PATH = "/cdn/graphql";
-function isCdnEligible(env, documentText, bearerToken) {
-  if (bearerToken) return false;
-  if (isFoirPreview(env)) return false;
-  const apiKey = resolveFoirApiKey(env);
-  if (!apiKey?.startsWith("pk_")) return false;
-  return !/\bmutation\b/.test(documentText);
+// src/transport/persisted-query.ts
+var FOIR_CDN_GRAPHQL_PATH = "/cdn/graphql";
+function persistedQueryExtension(hash) {
+  return { persistedQuery: { version: 1, sha256Hash: hash } };
 }
 function buildCdnUrl(endpoint, apiKey, hash, variables) {
   const url = new URL(endpoint);
-  url.pathname = url.pathname.replace(/\/graphql\/?$/, "") + CDN_PATH;
+  url.pathname = url.pathname.replace(/\/graphql\/?$/, "") + FOIR_CDN_GRAPHQL_PATH;
   url.searchParams.set("key", apiKey);
   url.searchParams.set("extensions", JSON.stringify(persistedQueryExtension(hash)));
   if (variables && Object.keys(variables).length > 0) {
@@ -136,18 +139,29 @@ function buildCdnUrl(endpoint, apiKey, hash, variables) {
   }
   return url.toString();
 }
-function persistedQueryExtension(hash) {
-  return { persistedQuery: { version: 1, sha256Hash: hash } };
-}
 async function documentHash(documentText) {
-  const digest = await crypto.subtle.digest(
-    "SHA-256",
-    new TextEncoder().encode(documentText)
-  );
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(documentText));
   return Array.from(new Uint8Array(digest)).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 var PERSISTED_QUERY_NOT_FOUND = "PERSISTED_QUERY_NOT_FOUND";
 var NOT_SHAREABLE = "NOT_SHAREABLE";
+async function hasFoirErrorCode(res, ...codes) {
+  try {
+    const body = await res.clone().json();
+    return body.errors?.some((e) => e.extensions?.code !== void 0 && codes.includes(e.extensions.code)) ?? false;
+  } catch {
+    return false;
+  }
+}
+
+// src/graphql/cdn-route.ts
+function isCdnEligible(env, documentText, bearerToken) {
+  if (bearerToken) return false;
+  if (isFoirPreview(env)) return false;
+  const apiKey = resolveFoirApiKey(env);
+  if (!apiKey?.startsWith("pk_")) return false;
+  return !/\bmutation\b/.test(documentText);
+}
 
 // src/graphql/foir-request.ts
 async function foirRequest(env, document, variables, options) {
@@ -242,83 +256,679 @@ async function readErrorEnvelope(res) {
   return errors;
 }
 async function isSharedRefusal(res) {
-  if (res.ok) return false;
-  try {
-    const body = await res.clone().json();
-    return body.errors?.some((e) => e.extensions?.code === NOT_SHAREABLE) ?? false;
-  } catch {
+  return hasFoirErrorCode(res, NOT_SHAREABLE);
+}
+async function isPersistedQueryMiss(res) {
+  return hasFoirErrorCode(res, PERSISTED_QUERY_NOT_FOUND);
+}
+
+// src/data/document.ts
+function buildPathTrie(paths) {
+  const root = { self: false, children: /* @__PURE__ */ new Map() };
+  for (const path of paths) {
+    let node = root;
+    for (const segment of path.split(".")) {
+      if (!segment) continue;
+      let next = node.children.get(segment);
+      if (!next) {
+        next = { self: false, children: /* @__PURE__ */ new Map() };
+        node.children.set(segment, next);
+      }
+      node = next;
+    }
+    node.self = true;
+  }
+  return root;
+}
+function childFor(node, field) {
+  return node.children.get(field.key) ?? (field.alias ? node.children.get(field.alias) : void 0);
+}
+function segmentFor(node, field) {
+  return node.children.has(field.key) ? field.key : field.alias ?? field.key;
+}
+var PROTECTED_ROOT_FIELD = "_id";
+var MAX_QUERY_COMPLEXITY = 1e4;
+var MAX_EMITTED_FIELDS = 4 * MAX_QUERY_COMPLEXITY;
+var newBudget = () => ({ fields: 0, emitted: 0, stopped: false });
+function charge(ctx, n = 1) {
+  ctx.budget.fields += n;
+  ctx.budget.emitted += n;
+}
+function mayExpand(ctx, depth) {
+  if (depth <= 1) return false;
+  if (ctx.budget.emitted > MAX_EMITTED_FIELDS) {
+    ctx.budget.stopped = true;
     return false;
   }
+  return true;
 }
-async function isPersistedQueryMiss(res) {
+function printFields(fields, ctx, omit, pick, isRoot, path, depth) {
+  const parts = [];
+  for (const field of fields) {
+    if (field.relation) {
+      const named = pick ? childFor(pick, field) : void 0;
+      if (named) {
+        const segment = segmentFor(pick, field);
+        throw new FoirRequestError(
+          `[foir] pick "${path}${segment}": "${segment}" is a relation, and relations are not part of the default document \u2014 no pick can select one. ` + (path ? (
+            // Nested: there is no `include` form that reaches here at all.
+            // `include` addresses the ROOT model's own relations, and (nested)
+            // a related model's — never one reached through a composite or a
+            // union member. Saying "use include" would send the caller to a
+            // call that refuses them a second time.
+            `A relation at this position cannot be reached by \`include\` either \u2014 that addresses the model's own relations, not one inside a composite or a union member. Read it through the field that owns it, or drop "${path}${segment}" from the pick`
+          ) : `Use include: { ${segment}: true } instead`)
+        );
+      }
+      continue;
+    }
+    const protectedField = isRoot && field.key === PROTECTED_ROOT_FIELD;
+    const omitChild = omit ? childFor(omit, field) : void 0;
+    if (omitChild?.self && !protectedField) continue;
+    let pickChild;
+    if (pick) {
+      pickChild = childFor(pick, field);
+      if (!pickChild && !protectedField) continue;
+      if (pickChild?.self) pickChild = void 0;
+    }
+    const head = field.alias ? `${field.alias}: ${field.key}` : field.key;
+    const childPath = `${path}${pick && childFor(pick, field) ? segmentFor(pick, field) : field.key}.`;
+    if (field.truncated) {
+      if (field.union && mayExpand(ctx, depth)) {
+        const body = printUnion(field.union, ctx, omitChild, pickChild, childPath, depth - 1);
+        if (body) {
+          charge(ctx);
+          parts.push(`${head} ${body}`);
+          continue;
+        }
+      }
+      charge(ctx, 2);
+      parts.push(`${head} { __typename }`);
+      continue;
+    }
+    if (field.model) {
+      const body = printModelTree(field.model, ctx, depth);
+      if (body) {
+        charge(ctx);
+        parts.push(`${head} { ${body} }`);
+      }
+      continue;
+    }
+    if (field.union) {
+      const body = printUnion(field.union, ctx, omitChild, pickChild, childPath, depth);
+      if (body) {
+        charge(ctx);
+        parts.push(`${head} ${body}`);
+      }
+      continue;
+    }
+    if (field.fields?.length) {
+      const body = printFields(field.fields, ctx, omitChild, pickChild, false, childPath, depth);
+      if (body) {
+        charge(ctx);
+        parts.push(`${head} { ${body} }`);
+      }
+      continue;
+    }
+    charge(ctx);
+    parts.push(head);
+  }
+  return parts.join(" ");
+}
+function printModelTree(modelKey, ctx, depth) {
+  const model = ctx.source.models[modelKey];
+  if (!model?.selection) {
+    throw new FoirRequestError(
+      `[foir] the result shape references the model "${modelKey}", which publishes no selection \u2014 re-run \`foir types\``
+    );
+  }
+  const narrowing = ctx.record?.modelKey === modelKey ? ctx.record : void 0;
+  const body = printFields(
+    model.selection.fields,
+    ctx,
+    narrowing?.omit,
+    narrowing?.pick,
+    true,
+    "",
+    depth
+  );
+  const includes = narrowing?.include ? printIncludes(ctx.source, model, modelKey, narrowing.include, ctx, depth) : "";
+  if (!body) {
+    return includes;
+  }
+  return includes ? `${body} ${includes}` : body;
+}
+var NO_FIELDS = { self: false, children: /* @__PURE__ */ new Map() };
+function addressesMembers(node, union) {
+  for (const member of union.members) {
+    if (node.children.has(member.typeName)) return true;
+  }
+  return false;
+}
+function printUnion(unionName, ctx, omit, pick, path, depth) {
+  const union = ctx.unions[unionName];
+  if (!union) {
+    throw new FoirRequestError(
+      `[foir] the selection tree names the union "${unionName}", which is not in selectionUnions \u2014 re-run \`foir types\`, or pass selectionUnions alongside selections`
+    );
+  }
+  const perVariantPick = pick !== void 0 && addressesMembers(pick, union);
+  const perVariantOmit = omit !== void 0 && addressesMembers(omit, union);
+  charge(ctx);
+  const parts = ["__typename"];
+  const chargeBefore = ctx.budget.fields;
+  let widestMember = 0;
+  for (const member of union.members) {
+    let memberPick = pick;
+    if (perVariantPick) {
+      const named = pick.children.get(member.typeName);
+      memberPick = named === void 0 ? NO_FIELDS : named.self ? void 0 : named;
+    }
+    let memberOmit = omit;
+    if (perVariantOmit) {
+      const named = omit.children.get(member.typeName);
+      if (named?.self) continue;
+      memberOmit = named;
+    }
+    const memberPath = perVariantPick ? `${path}${member.typeName}.` : path;
+    const memberStart = ctx.budget.fields;
+    const body = printFields(member.fields, ctx, memberOmit, memberPick, false, memberPath, depth);
+    const memberCost = ctx.budget.fields - memberStart;
+    ctx.budget.fields = memberStart;
+    if (memberCost > widestMember) widestMember = memberCost;
+    if (body) parts.push(`... on ${member.typeName} { ${body} }`);
+  }
+  ctx.budget.fields = chargeBefore + widestMember;
+  return `{ ${parts.join(" ")} }`;
+}
+function printIncludes(source, model, modelKey, include, ctx, depth) {
+  const parts = [];
+  for (const [key, value] of Object.entries(include)) {
+    if (value === void 0 || value === false) continue;
+    const relation = model.relations?.find((r) => r.key === key);
+    if (!relation) {
+      throw new FoirRequestError(
+        `[foir] include "${key}": ${modelKey} has no such relation \u2014 re-run \`foir types\` if the model has changed`
+      );
+    }
+    const nested = value && typeof value === "object" && "include" in value ? value["include"] : void 0;
+    const body = relation.targets?.length ? printPolymorphicRelation(source, relation, ctx, nested, depth) : printRelationTarget(source, relation.target ?? "", ctx, nested, relation.key, depth);
+    charge(ctx, relation.connection ? 1 + CONNECTION_WRAPPER_FIELDS : 1);
+    parts.push(`${key} ${relation.connection ? wrapRelationConnection(body) : `{ ${body} }`}`);
+  }
+  return parts.join(" ");
+}
+var CONNECTION_WRAPPER_FIELDS = 9;
+function wrapRelationConnection(body) {
+  return `{ edges { cursor node { ${body} } } pageInfo { hasNextPage hasPreviousPage startCursor endCursor } totalCount }`;
+}
+function printRelationTarget(source, targetKey, ctx, nested, relationKey, depth) {
+  const target = source.models[targetKey];
+  if (!target?.selection) {
+    throw new FoirRequestError(
+      `[foir] include "${relationKey}": no selection published for its target model "${targetKey}" \u2014 re-run \`foir types\``
+    );
+  }
+  const bare = { source, unions: ctx.unions, budget: ctx.budget };
+  const body = printFields(target.selection.fields, bare, void 0, void 0, true, "", depth);
+  const includes = nested ? printIncludes(source, target, targetKey, nested, bare, depth) : "";
+  return includes ? `${body} ${includes}` : body;
+}
+function printPolymorphicRelation(source, relation, ctx, nested, depth) {
+  charge(ctx);
+  const parts = ["__typename"];
+  const chargeBefore = ctx.budget.fields;
+  let widestTarget = 0;
+  for (const targetKey of relation.targets ?? []) {
+    const target = source.models[targetKey];
+    if (!target?.selection) {
+      throw new FoirRequestError(
+        `[foir] include "${relation.key}": no selection published for its target model "${targetKey}" \u2014 re-run \`foir types\``
+      );
+    }
+    const targetStart = ctx.budget.fields;
+    const body = printRelationTarget(source, targetKey, ctx, nested, relation.key, depth);
+    const targetCost = ctx.budget.fields - targetStart;
+    ctx.budget.fields = targetStart;
+    if (targetCost > widestTarget) widestTarget = targetCost;
+    if (body) parts.push(`... on ${target.typeName} { ${body} }`);
+  }
+  ctx.budget.fields = chargeBefore + widestTarget;
+  return parts.join(" ");
+}
+var GRAPHQL_TYPE_REF = /^\[?\[?[_A-Za-z][_0-9A-Za-z]*!?\]?!?\]?!?$/;
+function buildArguments(args, op, opLabel) {
+  const declared = op.args;
+  const definitions = [];
+  const call = [];
+  const variables = {};
+  for (const name of Object.keys(args).sort()) {
+    const value = args[name];
+    if (value === void 0) continue;
+    if (!declared?.includes(name)) {
+      throw new FoirRequestError(
+        `[foir] ${opLabel} does not take an argument "${name}" \u2014 it takes ${declared?.length ? declared.join(", ") : "no arguments"}`
+      );
+    }
+    const type = op.argTypes?.[name];
+    if (!type) {
+      throw new FoirRequestError(
+        `[foir] ${opLabel}: the manifest publishes no type for the argument "${name}", so it cannot be sent as a variable \u2014 and inferring one from the value would guess wrong on every enum. Re-run \`foir types\` against a server that publishes argTypes, or use foir.raw() with your own variable definitions`
+      );
+    }
+    if (!GRAPHQL_TYPE_REF.test(type)) {
+      throw new FoirRequestError(
+        `[foir] ${opLabel}: the manifest gives the argument "${name}" the type "${type}", which is not a GraphQL type reference`
+      );
+    }
+    definitions.push(`$${name}: ${type}`);
+    call.push(`${name}: $${name}`);
+    variables[name] = toVariableValue(value, `${opLabel} argument "${name}"`);
+  }
+  return {
+    definitions: definitions.length ? `(${definitions.join(", ")})` : "",
+    call: call.length ? `(${call.join(", ")})` : "",
+    variables
+  };
+}
+function toVariableValue(value, label) {
+  if (value === null) return null;
+  const kind = typeof value;
+  if (kind === "string" || kind === "boolean") return value;
+  if (kind === "number") {
+    if (!Number.isFinite(value)) {
+      throw new FoirRequestError(
+        `[foir] ${label} is ${String(value)}, which has no JSON form and cannot be sent`
+      );
+    }
+    return value;
+  }
+  if (kind === "bigint") {
+    const asNumber = Number(value);
+    if (!Number.isSafeInteger(asNumber)) {
+      throw new FoirRequestError(
+        `[foir] ${label} is the bigint ${String(value)}, which is outside the range JSON can carry exactly`
+      );
+    }
+    return asNumber;
+  }
+  if (value instanceof Date) {
+    if (Number.isNaN(value.getTime())) {
+      throw new FoirRequestError(`[foir] ${label} is an invalid Date`);
+    }
+    return value.toISOString();
+  }
+  if (Array.isArray(value)) {
+    return value.filter((item) => item !== void 0).map((item, index) => toVariableValue(item, `${label}[${index}]`));
+  }
+  if (kind === "object") {
+    const out = {};
+    for (const [key, child] of Object.entries(value)) {
+      if (child === void 0) continue;
+      out[key] = toVariableValue(child, `${label}.${key}`);
+    }
+    return out;
+  }
+  throw new FoirRequestError(
+    `[foir] ${label} is a ${kind}, which has no JSON form and cannot be sent`
+  );
+}
+function payloadRecordPaths(payload) {
+  if (payload.kind === "record") {
+    return payload.model ? [{ path: [], modelKey: payload.model }] : [];
+  }
+  const found = [];
+  const visit = (fields, prefix) => {
+    for (const field of fields ?? []) {
+      const at = [...prefix, field.alias ?? field.key];
+      if (field.model) found.push({ path: at, modelKey: field.model });
+      visit(field.fields, at);
+    }
+  };
+  visit(payload.fields, []);
+  return found;
+}
+function printPayload(payload, ctx, root, opLabel, depth) {
+  switch (payload.kind) {
+    case "leaf":
+      return void 0;
+    case "record": {
+      if (!payload.model) {
+        throw new FoirRequestError(
+          `[foir] ${opLabel}: the result shape says it is a record but names no model \u2014 re-run \`foir types\``
+        );
+      }
+      return printModelTree(payload.model, ctx, depth);
+    }
+    case "union": {
+      if (!payload.union) {
+        throw new FoirRequestError(
+          `[foir] ${opLabel}: the result shape says it is a union but names none \u2014 re-run \`foir types\``
+        );
+      }
+      return printUnion(payload.union, ctx, root.omit, root.pick, "", depth).slice(2, -2);
+    }
+    case "object": {
+      if (!payload.fields?.length) {
+        throw new FoirRequestError(
+          `[foir] ${opLabel}: the result shape is an object with no fields \u2014 re-run \`foir types\``
+        );
+      }
+      return printFields(payload.fields, ctx, root.omit, root.pick, false, "", depth);
+    }
+    default:
+      throw new FoirRequestError(
+        `[foir] ${opLabel}: the result shape has the kind "${String(payload.kind)}", which this client does not know how to print \u2014 upgrade @foir/sdk`
+      );
+  }
+}
+var DEFAULT_DEPTH = 1;
+function planFoirNamespaceCall(source, call) {
+  const namespace = source.namespaces?.[call.namespace];
+  if (!namespace) {
+    throw new FoirRequestError(
+      `[foir] no namespace "${call.namespace}" in this credential's surface \u2014 re-run \`foir types\``
+    );
+  }
+  const opDef = namespace.ops?.[call.op];
+  if (!opDef) {
+    throw new FoirRequestError(
+      `[foir] the namespace "${call.namespace}" has no op "${call.op}" for this credential \u2014 re-run \`foir types\``
+    );
+  }
+  return planCall(
+    source,
+    opDef,
+    `${call.namespace}.${call.op}`,
+    operationName(call.namespace, call.op),
+    call
+  );
+}
+function planCall(source, opDef, opLabel, name, call) {
+  const payload = opDef.payload;
+  if (!payload) {
+    throw new FoirRequestError(
+      `[foir] ${opLabel}: the manifest publishes no result shape for this op, so there is nothing to print \u2014 and synthesising one client-side is exactly the guess this client refuses to make. Re-run \`foir types\` against a server that publishes op payloads`
+    );
+  }
+  if (payload.error) {
+    throw new FoirRequestError(
+      `[foir] ${opLabel}: the server could not resolve a result shape for this op: ${payload.error}`
+    );
+  }
+  if (call.omit && call.pick) {
+    throw new FoirRequestError(
+      `[foir] ${opLabel}: "omit" and "pick" are mutually exclusive \u2014 pass one or the other`
+    );
+  }
+  if (call.omit?.includes(PROTECTED_ROOT_FIELD)) {
+    throw new FoirRequestError(
+      `[foir] omit "${PROTECTED_ROOT_FIELD}": "${PROTECTED_ROOT_FIELD}" is required for correctness and cannot be removed`
+    );
+  }
+  const depth = call.depth ?? DEFAULT_DEPTH;
+  if (!Number.isInteger(depth) || depth < DEFAULT_DEPTH) {
+    throw new FoirRequestError(
+      `[foir] ${opLabel}: depth must be a whole number of union levels, ${DEFAULT_DEPTH} or more \u2014 got ${String(call.depth)}. ${DEFAULT_DEPTH} is the complete-by-default document; each level above it expands one further union`
+    );
+  }
+  const omit = call.omit?.length ? buildPathTrie(call.omit) : void 0;
+  const pick = call.pick?.length ? buildPathTrie(call.pick) : void 0;
+  const include = call.include && Object.keys(call.include).length ? call.include : void 0;
+  const narrowed = Boolean(omit || pick || include);
+  const recordPaths = payloadRecordPaths(payload);
+  const records = new Set(recordPaths.map((entry) => entry.modelKey));
+  if (records.size > 1 && narrowed) {
+    throw new FoirRequestError(
+      `[foir] ${opLabel}: the result carries records of more than one model (${[...records].sort().join(", ")}), so "include"/"pick"/"omit" do not say which one they mean \u2014 call it without them and narrow with foir.raw()`
+    );
+  }
+  const recordModel = records.size === 1 ? [...records][0] : void 0;
+  if (include && !recordModel) {
+    throw new FoirRequestError(
+      `[foir] ${opLabel}: "include" names relations of a record, and this op returns none`
+    );
+  }
+  const ctx = {
+    source,
+    unions: source.selectionUnions ?? {},
+    record: recordModel ? { modelKey: recordModel, omit, pick, include } : void 0,
+    budget: newBudget()
+  };
+  const root = recordModel ? {} : { omit, pick };
+  const selection = printPayload(payload, ctx, root, opLabel, depth);
+  if (selection === "") {
+    throw new FoirRequestError(
+      `[foir] ${opLabel}: the selection is empty after applying pick/omit \u2014 a GraphQL selection set cannot be empty`
+    );
+  }
+  charge(ctx);
+  if (depth > DEFAULT_DEPTH && (ctx.budget.stopped || ctx.budget.fields > MAX_QUERY_COMPLEXITY)) {
+    const reason = ctx.budget.stopped ? `expands to more than ${MAX_EMITTED_FIELDS} fields to print, which is past what this client will build in one call` : `makes this document select ${ctx.budget.fields} fields, over the server's limit of ${MAX_QUERY_COMPLEXITY}`;
+    throw new FoirRequestError(
+      `[foir] ${opLabel}: depth ${depth} ${reason}. Each level re-expands every stopping point inside the expansion, so spend the level on less: narrow with "pick"/"omit" \u2014 including per-member, pick: { <field>: { on: { <MemberType>: [...] } } } \u2014 or ask for depth ${depth - 1}`
+    );
+  }
+  const args = buildArguments(call.args, opDef, opLabel);
+  const keyword = opDef.mutation ? "mutation" : "query";
+  const body = selection === void 0 ? "" : ` { ${selection} }`;
+  return {
+    document: `${keyword} ${name}${args.definitions} { ${opDef.field}${args.call}${body} }`,
+    variables: args.variables,
+    mutation: opDef.mutation === true,
+    rootField: opDef.field,
+    fields: ctx.budget.fields,
+    records: recordPaths
+  };
+}
+function operationName(scope, op) {
+  const parts = `${scope} ${op}`.split(/[^0-9A-Za-z]+/).filter(Boolean).map((part) => part.charAt(0).toUpperCase() + part.slice(1));
+  const name = parts.join("");
+  return /^[_A-Za-z]/.test(name) ? name : `Foir${name}`;
+}
+
+// src/data/transport.ts
+function foirDataEndpoint(apiUrl, path) {
+  return foirApiEndpoint(apiUrl, path);
+}
+async function resolveBearerToken(config) {
+  const source = config.bearerToken;
+  if (typeof source === "function") return await source() ?? void 0;
+  return source ?? void 0;
+}
+function foirRoute(input) {
+  if (!input.apiKey.startsWith("pk_")) return { lane: "origin", reason: "key" };
+  if (input.bearerToken) return { lane: "origin", reason: "bearer" };
+  if (input.mutation) return { lane: "origin", reason: "operation" };
+  if (input.channel === "draft") return { lane: "origin", reason: "channel" };
+  return { lane: "shared" };
+}
+async function executeFoirDocument(config, plan) {
+  const data = await runFoirDocument(config, plan.document, plan.mutation, plan.variables);
+  if (!(plan.rootField in data)) {
+    throw new FoirRequestError(
+      `[foir] the response has no "${plan.rootField}" field` + (Object.keys(data).length ? ` (got ${Object.keys(data).join(", ")})` : "")
+    );
+  }
+  return data[plan.rootField];
+}
+async function runFoirDocument(config, document, mutation, variables) {
+  const doFetch = config.fetch ?? globalThis.fetch;
+  const endpoint = foirDataEndpoint(config.apiUrl, "/graphql");
+  const bearerToken = await resolveBearerToken(config);
+  const headers = buildFoirHeaders({
+    apiKey: config.apiKey,
+    draftChannel: config.channel === "draft",
+    bearerToken,
+    extra: config.headers
+  });
+  const hash = await documentHash(document);
+  const route = foirRoute({
+    apiKey: config.apiKey,
+    bearerToken,
+    mutation,
+    channel: config.channel
+  });
+  const post = (body) => doFetch(endpoint, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(body),
+    ...config.requestInit
+  });
+  const extensions = persistedQueryExtension(hash);
+  let res;
   try {
-    const body = await res.clone().json();
-    return body.errors?.some(
-      (e) => e.extensions?.code === PERSISTED_QUERY_NOT_FOUND
-    ) ?? false;
+    if (route.lane === "shared") {
+      res = await doFetch(buildCdnUrl(endpoint, config.apiKey, hash, variables), {
+        method: "GET",
+        headers,
+        ...config.requestInit
+      });
+      if (await hasFoirErrorCode(res, PERSISTED_QUERY_NOT_FOUND, NOT_SHAREABLE)) {
+        res = await post({ query: document, variables, extensions });
+      }
+    } else {
+      res = await post({ variables, extensions });
+      if (await hasFoirErrorCode(res, PERSISTED_QUERY_NOT_FOUND)) {
+        res = await post({ query: document, variables, extensions });
+      }
+    }
+  } catch (err) {
+    throw new FoirRequestError("[foir] network error", { cause: err });
+  }
+  if (!res.ok) {
+    const errors = await readErrorBody(res);
+    const detail = errors ? `: ${errors.map((e) => e.message).join("; ")}` : "";
+    throw new FoirRequestError(`[foir] HTTP ${res.status} ${res.statusText}${detail}`, {
+      status: res.status,
+      graphQLErrors: errors
+    });
+  }
+  const json = await res.json();
+  return readFoirEnvelope(json);
+}
+async function readErrorBody(res) {
+  try {
+    const json = await res.json();
+    return json?.errors?.length ? json.errors : void 0;
   } catch {
-    return false;
+    return void 0;
+  }
+}
+
+// src/data/manifest.ts
+async function fetchFoirManifest(config) {
+  const url = foirDataEndpoint(config.apiUrl, "/v1/manifest");
+  const doFetch = config.fetch ?? globalThis.fetch;
+  let res;
+  try {
+    res = await doFetch(url, {
+      method: "GET",
+      headers: buildFoirHeaders({
+        apiKey: config.apiKey,
+        draftChannel: config.channel === "draft",
+        bearerToken: await resolveBearerToken(config),
+        extra: config.headers
+      }),
+      ...config.requestInit
+    });
+  } catch (err) {
+    throw new FoirRequestError("[foir] network error", { cause: err });
+  }
+  if (!res.ok) {
+    throw new FoirRequestError(
+      `[foir] GET /v1/manifest failed: HTTP ${res.status} ${res.statusText}`,
+      { status: res.status }
+    );
   }
+  return await res.json();
 }
 
-// src/auth/operations.ts
-import { parse } from "graphql";
-var AUTH_RESULT_FIELDS = "token refreshToken customerId email";
-var CustomerLoginDocument = parse(
-  `mutation CustomerLogin($email: String!, $password: String!) {
-    customerLogin(email: $email, password: $password) { ${AUTH_RESULT_FIELDS} }
-  }`
-);
-var CustomerRegisterDocument = parse(
-  `mutation CustomerRegister($email: String!, $password: String!) {
-    customerRegister(email: $email, password: $password) { ${AUTH_RESULT_FIELDS} }
-  }`
-);
-var CustomerRefreshTokenDocument = parse(
-  `mutation CustomerRefreshToken($refreshToken: String!) {
-    customerRefreshToken(refreshToken: $refreshToken) { ${AUTH_RESULT_FIELDS} }
-  }`
-);
-var CustomerRequestOTPDocument = parse(
-  `mutation CustomerRequestOTP($email: String!) {
-    customerRequestOTP(email: $email)
-  }`
-);
-var CustomerLoginOTPDocument = parse(
-  `mutation CustomerLoginOTP($email: String!, $otp: String!) {
-    customerLoginOTP(email: $email, otp: $otp) { ${AUTH_RESULT_FIELDS} }
-  }`
-);
-var CustomerLoginWithProviderDocument = parse(
-  `mutation CustomerLoginWithProvider($input: ProviderLoginInput!) {
-    customerLoginWithProvider(input: $input) { redirectUrl token }
-  }`
-);
-var CustomerProviderCallbackDocument = parse(
-  `mutation CustomerProviderCallback($input: ProviderCallbackInput!) {
-    customerProviderCallback(input: $input) { ${AUTH_RESULT_FIELDS} }
-  }`
-);
-var CustomerProviderVerifyOTPDocument = parse(
-  `mutation CustomerProviderVerifyOTP($input: ProviderOTPVerifyInput!) {
-    customerProviderVerifyOTP(input: $input) { ${AUTH_RESULT_FIELDS} }
-  }`
-);
-var AuthProvidersDocument = parse(
-  `query AuthProviders {
-    authProviders { key name type isDefault }
-  }`
-);
-var CustomerJoinWaitlistDocument = parse(
-  `mutation CustomerJoinWaitlist($email: String!) {
-    customerJoinWaitlist(email: $email) { id email status }
-  }`
-);
-var CustomerSignupContextDocument = parse(
-  `query CustomerSignupContext {
-    customerSignupContext { signupMode }
-  }`
-);
+// src/auth/ops.ts
+var AUTH_OPS = {
+  // Pre-credential reads a login screen renders itself from.
+  authConfig: "authConfig",
+  authProviders: "authProviders",
+  defaultAuthProvider: "defaultAuthProvider",
+  customerSignupContext: "customerSignupContext",
+  // Post-credential self reads.
+  currentUser: "currentUser",
+  myProviderToken: "myProviderToken",
+  // Methods.
+  customerLogin: "customerLogin",
+  customerRegister: "customerRegister",
+  customerRequestOTP: "customerRequestOTP",
+  customerLoginOTP: "customerLoginOTP",
+  // Session lifecycle.
+  customerRefreshToken: "customerRefreshToken",
+  customerLogout: "customerLogout",
+  customerJoinWaitlist: "customerJoinWaitlist",
+  // Password management and account lifecycle — the block that had no path.
+  customerRequestPasswordReset: "customerRequestPasswordReset",
+  customerResetPassword: "customerResetPassword",
+  customerUpdatePassword: "customerUpdatePassword",
+  customerVerifyEmail: "customerVerifyEmail",
+  deleteMyAccount: "deleteMyAccount",
+  // External identity providers.
+  customerLoginWithProvider: "customerLoginWithProvider",
+  customerProviderCallback: "customerProviderCallback",
+  customerProviderVerifyOTP: "customerProviderVerifyOTP"
+};
+function authClientConfig(env, options) {
+  const apiKey = resolveFoirApiKey(env);
+  if (!apiKey) {
+    throw new FoirRequestError(
+      "[foir] no api key configured: set PLATFORM_API_KEY (or PLATFORM_PREVIEW_API_KEY under FOIR_PREVIEW=true)"
+    );
+  }
+  const apiUrl = env.PLATFORM_API_URL;
+  if (!apiUrl) {
+    throw new FoirRequestError("[foir] no api url configured: set PLATFORM_API_URL");
+  }
+  return {
+    apiUrl,
+    apiKey,
+    channel: isFoirPreview(env) ? "draft" : "published",
+    bearerToken: options?.bearerToken,
+    headers: options?.headers,
+    fetch: options?.fetch
+  };
+}
+var MANIFEST_CACHE_LIMIT = 8;
+var manifestCache = /* @__PURE__ */ new Map();
+function authManifest(config) {
+  const key = `${config.apiUrl}\0${config.apiKey}\0${config.channel ?? "published"}`;
+  const held = manifestCache.get(key);
+  if (held) return held;
+  const pending = fetchFoirManifest(config).catch((err) => {
+    manifestCache.delete(key);
+    throw err;
+  });
+  manifestCache.set(key, pending);
+  while (manifestCache.size > MANIFEST_CACHE_LIMIT) {
+    const oldest = manifestCache.keys().next();
+    if (oldest.done) break;
+    manifestCache.delete(oldest.value);
+  }
+  return pending;
+}
+async function authOp(env, op, args, options) {
+  const config = authClientConfig(env, options);
+  const manifest = await authManifest(config);
+  const plan = planFoirNamespaceCall(manifest, {
+    namespace: "auth",
+    op,
+    args: args ? stripUndefined(args) : {}
+  });
+  return executeFoirDocument(config, plan);
+}
+function stripUndefined(args) {
+  const out = {};
+  for (const [key, value] of Object.entries(args)) {
+    if (value !== void 0) out[key] = value;
+  }
+  return out;
+}
 
 // src/auth/auth.ts
 var TOKEN_KEY = "foir:token";
@@ -326,37 +936,67 @@ var REFRESH_KEY = "foir:refreshToken";
 var CUSTOMER_ID_KEY = "foir:customerId";
 var EMAIL_KEY = "foir:email";
 async function customerLogin(env, vars) {
-  return (await foirRequest(env, CustomerLoginDocument, vars)).customerLogin;
+  return authOp(env, AUTH_OPS.customerLogin, vars);
 }
 async function customerRegister(env, vars) {
-  return (await foirRequest(env, CustomerRegisterDocument, vars)).customerRegister;
+  return authOp(env, AUTH_OPS.customerRegister, vars);
 }
 async function customerRequestOTP(env, email) {
-  return (await foirRequest(env, CustomerRequestOTPDocument, { email })).customerRequestOTP;
+  return authOp(env, AUTH_OPS.customerRequestOTP, { email });
 }
 async function customerLoginOTP(env, vars) {
-  return (await foirRequest(env, CustomerLoginOTPDocument, vars)).customerLoginOTP;
+  return authOp(env, AUTH_OPS.customerLoginOTP, vars);
 }
 async function customerRefreshToken(env, refreshToken) {
-  return (await foirRequest(env, CustomerRefreshTokenDocument, { refreshToken })).customerRefreshToken;
+  return authOp(env, AUTH_OPS.customerRefreshToken, { refreshToken });
 }
 async function customerLoginWithProvider(env, input) {
-  return (await foirRequest(env, CustomerLoginWithProviderDocument, { input })).customerLoginWithProvider;
+  return authOp(env, AUTH_OPS.customerLoginWithProvider, { input });
 }
 async function customerProviderCallback(env, input) {
-  return (await foirRequest(env, CustomerProviderCallbackDocument, { input })).customerProviderCallback;
+  return authOp(env, AUTH_OPS.customerProviderCallback, { input });
 }
 async function customerProviderVerifyOTP(env, input) {
-  return (await foirRequest(env, CustomerProviderVerifyOTPDocument, { input })).customerProviderVerifyOTP;
+  return authOp(env, AUTH_OPS.customerProviderVerifyOTP, { input });
 }
 async function getAuthProviders(env) {
-  return (await foirRequest(env, AuthProvidersDocument, {})).authProviders;
+  return authOp(env, AUTH_OPS.authProviders);
+}
+async function getAuthConfig(env) {
+  return authOp(env, AUTH_OPS.authConfig);
+}
+async function getDefaultAuthProvider(env) {
+  return authOp(env, AUTH_OPS.defaultAuthProvider);
 }
 async function customerSignupContext(env) {
-  return (await foirRequest(env, CustomerSignupContextDocument, {})).customerSignupContext;
+  return authOp(env, AUTH_OPS.customerSignupContext);
 }
 async function customerJoinWaitlist(env, email) {
-  return (await foirRequest(env, CustomerJoinWaitlistDocument, { email })).customerJoinWaitlist;
+  return authOp(env, AUTH_OPS.customerJoinWaitlist, { email });
+}
+async function customerRequestPasswordReset(env, email) {
+  return authOp(env, AUTH_OPS.customerRequestPasswordReset, { email });
+}
+async function customerResetPassword(env, vars) {
+  return authOp(env, AUTH_OPS.customerResetPassword, vars);
+}
+async function customerVerifyEmail(env, token) {
+  return authOp(env, AUTH_OPS.customerVerifyEmail, { token });
+}
+async function customerUpdatePassword(env, vars, options) {
+  return authOp(env, AUTH_OPS.customerUpdatePassword, vars, options);
+}
+async function currentUser(env, options) {
+  return authOp(env, AUTH_OPS.currentUser, void 0, options);
+}
+async function myProviderToken(env, providerKey, options) {
+  return authOp(env, AUTH_OPS.myProviderToken, { providerKey }, options);
+}
+async function customerLogout(env, options) {
+  return authOp(env, AUTH_OPS.customerLogout, void 0, options);
+}
+async function deleteMyAccount(env, vars, options) {
+  return authOp(env, AUTH_OPS.deleteMyAccount, vars, options);
 }
 async function saveSession(adapter, result) {
   await adapter.set(TOKEN_KEY, result.token);
@@ -389,6 +1029,19 @@ async function registerWithPassword(adapter, env, vars) {
 async function loginWithOTP(adapter, env, vars) {
   return saveSession(adapter, await customerLoginOTP(env, vars));
 }
+async function resetPasswordAndSignIn(adapter, env, vars) {
+  return saveSession(adapter, await customerResetPassword(env, vars));
+}
+async function signOut(adapter, env) {
+  const token = await getSessionToken(adapter);
+  if (token) {
+    try {
+      await customerLogout(env, { bearerToken: token });
+    } catch {
+    }
+  }
+  await clearSession(adapter);
+}
 async function refreshSession(adapter, env) {
   const refreshToken = await adapter.get(REFRESH_KEY) ?? null;
   if (!refreshToken) return null;
@@ -423,6 +1076,17 @@ async function authedRequest(adapter, env, document, variables) {
     });
   }
 }
+async function authedOp(adapter, env, op, args) {
+  const token = await getSessionToken(adapter);
+  try {
+    return await authOp(env, op, args, { bearerToken: token ?? void 0 });
+  } catch (err) {
+    if (!isAuthExpiredError(err)) throw err;
+    const refreshed = await refreshSession(adapter, env);
+    if (!refreshed) throw err;
+    return authOp(env, op, args, { bearerToken: refreshed.token });
+  }
+}
 async function requireAuth(adapter, options) {
   const token = await getSessionToken(adapter);
   const customer = await getSessionCustomer(adapter);
@@ -447,6 +1111,7 @@ async function requireAdmin(adapter, options) {
 // src/auth/hosted.ts
 var DEFAULT_COOKIE_NAME = "foir_customer_session";
 var DEFAULT_SESSION_PATH = "/session/token";
+var DEFAULT_END_SESSION_PATH = "/session/end-session";
 function hostedLoginUrl(config, returnTo) {
   const dest = new URL(config.loginOrigin);
   if (returnTo && returnTo !== "/") {
@@ -454,6 +1119,15 @@ function hostedLoginUrl(config, returnTo) {
   }
   return dest.toString();
 }
+function hostedLogoutUrl(config, clientId, returnTo) {
+  const path = config.endSessionPath ?? DEFAULT_END_SESSION_PATH;
+  const dest = new URL(path, config.loginOrigin);
+  dest.searchParams.set("client_id", clientId);
+  if (returnTo) {
+    dest.searchParams.set("post_logout_redirect_uri", returnTo);
+  }
+  return dest.toString();
+}
 async function fetchHostedSession(request, config) {
   const cookieName = config.cookieName ?? DEFAULT_COOKIE_NAME;
   const sessionPath = config.sessionPath ?? DEFAULT_SESSION_PATH;
@@ -620,38 +1294,44 @@ function trimSlash(s) {
   return s.replace(/\/+$/, "");
 }
 export {
-  AuthProvidersDocument,
-  CustomerLoginDocument,
-  CustomerLoginOTPDocument,
-  CustomerLoginWithProviderDocument,
-  CustomerProviderCallbackDocument,
-  CustomerProviderVerifyOTPDocument,
-  CustomerRefreshTokenDocument,
-  CustomerRegisterDocument,
-  CustomerRequestOTPDocument,
+  AUTH_OPS,
+  authedOp,
   authedRequest,
   clearSession,
   createFoirSessionClient,
+  currentUser,
   customerJoinWaitlist,
   customerLogin,
   customerLoginOTP,
   customerLoginWithProvider,
+  customerLogout,
   customerProviderCallback,
   customerProviderVerifyOTP,
   customerRefreshToken,
   customerRegister,
   customerRequestOTP,
+  customerRequestPasswordReset,
+  customerResetPassword,
   customerSignupContext,
+  customerUpdatePassword,
+  customerVerifyEmail,
+  deleteMyAccount,
   fetchHostedSession,
+  getAuthConfig,
   getAuthProviders,
+  getDefaultAuthProvider,
   getSessionCustomer,
   getSessionToken,
   hostedLoginUrl,
+  hostedLogoutUrl,
   loginWithOTP,
   loginWithPassword,
+  myProviderToken,
   refreshSession,
   registerWithPassword,
   requireAdmin,
   requireAuth,
-  saveSession
+  resetPasswordAndSignIn,
+  saveSession,
+  signOut
 };