@graphit/cli 0.2.68 → 0.2.73

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (25) hide show
  1. package/.claude-plugin/marketplace.json +3 -3
  2. package/.claude-plugin/plugin.json +1 -1
  3. package/.codex-plugin/plugin.json +1 -1
  4. package/README.md +2 -0
  5. package/bin/graphit +10 -1
  6. package/bin/graphit.ps1 +8 -1
  7. package/dist/api/client.js +4 -1
  8. package/dist/api/client.js.map +1 -1
  9. package/dist/auth/token.js +11 -1
  10. package/dist/auth/token.js.map +1 -1
  11. package/dist/ca-guard.d.ts +1 -0
  12. package/dist/ca-guard.js +41 -0
  13. package/dist/ca-guard.js.map +1 -0
  14. package/dist/index.d.ts +1 -1
  15. package/dist/index.js +4 -0
  16. package/dist/index.js.map +1 -1
  17. package/package.json +1 -1
  18. package/skills/graphit/SKILL.md +2 -2
  19. package/skills/graphit/VERSION.json +1 -1
  20. package/skills/graphit/references/chart-patterns.md +26 -23
  21. package/skills/graphit/references/chart-selection.md +14 -14
  22. package/skills/graphit/references/filters-advanced.md +1 -1
  23. package/skills/graphit/references/filters.md +3 -3
  24. package/skills/graphit/references/presentations.md +2 -2
  25. package/skills/graphit/references/runtime.md +17 -26
package/.claude-plugin/marketplace.json CHANGED
@@ -7,7 +7,7 @@
7
7
  },
8
8
  "metadata": {
9
9
  "description": "Graphit CLI plugin for AI coding assistants",
10
- "version": "0.2.68"
10
+ "version": "0.2.73"
11
11
  },
12
12
  "plugins": [
13
13
  {
@@ -16,9 +16,9 @@
16
16
  "source": {
17
17
  "source": "npm",
18
18
  "package": "@graphit/cli",
19
- "version": "0.2.68"
19
+ "version": "0.2.73"
20
20
  },
21
- "version": "0.2.68",
21
+ "version": "0.2.73",
22
22
  "category": "data-visualization",
23
23
  "tags": [
24
24
  "bi",
package/.claude-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "graphit",
3
- "version": "0.2.68",
3
+ "version": "0.2.73",
4
4
  "description": "Build custom HTML dashboards from real data using the Graphit CLI. KB-aware queries, entity wrapping, cached data sources.",
5
5
  "author": {
6
6
  "name": "Graphit",
package/.codex-plugin/plugin.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "graphit",
3
- "version": "0.2.68",
3
+ "version": "0.2.73",
4
4
  "description": "Build custom HTML dashboards from real data using the Graphit CLI. KB-aware queries, entity wrapping, cached data sources.",
5
5
  "author": {
6
6
  "name": "Graphit",
package/README.md CHANGED
@@ -61,6 +61,8 @@ graphit auth logout # Clear stored credentials
61
61
 
62
62
  The CLI talks to `https://api.graphit-app.com` by default. Set `GRAPHIT_API_URL` to point at a different backend.
63
63
 
64
+ TLS connections are verified against Node's bundled CA certificates, which already cover the public Graphit API. If you are behind a corporate TLS-inspecting proxy whose root certificate lives only in your operating system's trust store, set `GRAPHIT_USE_SYSTEM_CA=1` to also trust the system store. It is off by default because reading the system store is unnecessary for normal use and can crash under sandboxed agent runtimes (e.g. an editor's command sandbox on macOS, where keychain access is blocked).
65
+
64
66
  ## Commands
65
67
 
66
68
  | Group | What it does |
package/bin/graphit CHANGED
@@ -14,7 +14,7 @@ if [ -z "${GRAPHIT_PLUGIN_ROOT:-}" ]; then
14
14
  fi
15
15
 
16
16
  # graphit:floor (stamped by scripts/sync-plugin-version.mjs from cli/package.json)
17
- FLOOR_VERSION="0.2.68"
17
+ FLOOR_VERSION="0.2.73"
18
18
 
19
19
  PACKAGE_NAME="@graphit/cli"
20
20
  # Strict semver: anything else is rejected so a tampered cache cannot inject.
@@ -46,6 +46,15 @@ if ! command -v npx >/dev/null 2>&1; then
46
46
  exit 127
47
47
  fi
48
48
 
49
+ # Feature #679: Node reads the macOS keychain for TLS CA verification when
50
+ # NODE_USE_SYSTEM_CA=1 (injected by some agent runtimes); the Claude Code sandbox
51
+ # blocks keychain access -> a native crash on the first networked command. Drop it so
52
+ # Node uses its bundled CA, which already verifies Graphit's API. Opt back into the
53
+ # system trust store with GRAPHIT_USE_SYSTEM_CA=1 (corporate TLS-inspecting proxy).
54
+ if [ -z "${GRAPHIT_USE_SYSTEM_CA:-}" ]; then
55
+ unset NODE_USE_SYSTEM_CA
56
+ fi
57
+
49
58
  # Safe argv: the version is strict-semver-validated and passed as one quoted token,
50
59
  # and user arguments are forwarded verbatim via "$@", so a malformed or tampered
51
60
  # cache value can neither break execution nor widen command construction.
package/bin/graphit.ps1 CHANGED
@@ -7,7 +7,7 @@ if (-not $env:GRAPHIT_PLUGIN_ROOT) {
7
7
  }
8
8
 
9
9
  # graphit:floor (stamped by scripts/sync-plugin-version.mjs from cli/package.json)
10
- $FloorVersion = "0.2.68"
10
+ $FloorVersion = "0.2.73"
11
11
 
12
12
  $PackageName = "@graphit/cli"
13
13
  # Strict semver: anything else is rejected so a tampered cache cannot inject.
@@ -37,6 +37,13 @@ if (-not (Get-Command npx -ErrorAction SilentlyContinue)) {
37
37
  exit 127
38
38
  }
39
39
 
40
+ # Feature #679: see the bash wrapper. Drop NODE_USE_SYSTEM_CA unless the user opted
41
+ # in, so Node uses its bundled CA (reading the system trust store crashes under the
42
+ # Claude Code sandbox on macOS; bundled CA already verifies Graphit's API).
43
+ if (-not $env:GRAPHIT_USE_SYSTEM_CA) {
44
+ Remove-Item Env:\NODE_USE_SYSTEM_CA -ErrorAction SilentlyContinue
45
+ }
46
+
40
47
  # Safe argv: $version is strict-semver-validated; user args forwarded verbatim.
41
48
  & npx -y "$PackageName@$version" @args
42
49
  exit $LASTEXITCODE
package/dist/api/client.js CHANGED
@@ -174,7 +174,10 @@ function classifyNetworkError(err, baseUrl, timeoutMs = REQUEST_TIMEOUT_MS) {
174
174
  return `Connection reset by the server. Try again. (${baseUrl})`;
175
175
  }
176
176
  if (lower.includes("unable to get local issuer certificate") || lower.includes("cert")) {
177
- return `TLS certificate error. Check your network or proxy settings.`;
177
+ // Feature #679: with NODE_USE_SYSTEM_CA dropped, bundled CA can't verify a
178
+ // corporate TLS-inspecting proxy's re-signed cert. Point the user at the
179
+ // opt-in escape hatch instead of a dead-end "check your settings".
180
+ return `TLS certificate error. If you are behind a corporate proxy, set GRAPHIT_USE_SYSTEM_CA=1 to trust your system certificates; otherwise check your network or proxy settings.`;
178
181
  }
179
182
  return `Could not reach the API at ${baseUrl}. Check your connection.`;
180
183
  }
package/dist/api/client.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAE7D,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,+EAA+E;AAC/E,kFAAkF;AAClF,8EAA8E;AAC9E,MAAM,cAAc,GAAG,iBAAiB,EAAE,CAAC;AAC3C,MAAM,aAAa,GAAG,sBAAsB,CAAC,cAAc,CAAC,CAAC;AAQ7D,MAAM,SAAS;IACb,KAAK,CAAC,OAAO,CACX,MAAc,EACd,IAAY,EACZ,IAAc,EACd,IAA6B;QAE7B,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC,MAAM,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE;YACxC,aAAa,EAAE,UAAU,QAAQ,EAAE;SACpC,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,IAAY,EACZ,IAAa;QAEb,OAAO,IAAI,CAAC,MAAM,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,IAAY;QACvB,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAa,EAAE,IAA6B;QACtE,OAAO,IAAI,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,IAAa;QACtC,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,KAAK,CAAI,IAAY,EAAE,IAAa;QACxC,OAAO,IAAI,CAAC,OAAO,CAAI,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,MAAM,CAAI,IAAY;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAI,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CACjB,IAAY,EACZ,IAAc,EACd,IAA6B;QAE7B,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,GAAG,aAAa,EAAE,GAAG,IAAI,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,IAAI,EAAE,SAAS,IAAI,kBAAkB,CAAC;QACtD,MAAM,OAAO,GAA2B;YACtC,kBAAkB,EAAE,KAAK;YACzB,wBAAwB,EAAE,cAAc;YACxC,uBAAuB,EAAE,aAAa;YACtC,aAAa,EAAE,UAAU,QAAQ,EAAE;SACpC,CAAC;QAEF,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBACtB,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;aACrC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,EAAE,aAAa,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAC;QAC/C,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAM,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,IAAY,EACZ,IAAc,EACd,IAA6B;QAE7B,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,GAAG,aAAa,EAAE,GAAG,IAAI,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,IAAI,EAAE,SAAS,IAAI,kBAAkB,CAAC;QACtD,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,kBAAkB,EAAE,KAAK;YACzB,wBAAwB,EAAE,cAAc;YACxC,uBAAuB,EAAE,aAAa;YACtC,aAAa,EAAE,UAAU,QAAQ,EAAE;SACpC,CAAC;QAEF,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBACtB,MAAM;gBACN,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;aACrC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,EAAE,aAAa,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,0BAA0B,CAAC;QACnF,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC;QAClE,MAAM,aAAa,GAAG,WAAW,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAE9D,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC7B,WAAW;YACX,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;SAClD,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,MAAM,CAClB,MAAc,EACd,IAAY,EACZ,IAAc,EACd,YAAqC,EACrC,SAAkB;QAElB,MAAM,GAAG,GAAG,GAAG,aAAa,EAAE,GAAG,IAAI,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,SAAS,IAAI,kBAAkB,CAAC;QAChD,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,kBAAkB,EAAE,KAAK;YACzB,wBAAwB,EAAE,cAAc;YACxC,uBAAuB,EAAE,aAAa;YACtC,GAAG,YAAY;SAChB,CAAC;QAEF,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBACtB,MAAM;gBACN,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;aACrC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,EAAE,aAAa,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAC;QAC/C,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAM,CAAC;IAClC,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,kBAAkB,CAAC,IAAc;QAC7C,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,8EAA8E;QAChF,CAAC;QACD,MAAM,GAAG,GAAa;YACpB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;SAChD,CAAC;QACF,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACxB,GAAG,CAAC,mBAAmB,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAED,SAAS,oBAAoB,CAAC,GAAY,EAAE,OAAe,EAAE,SAAS,GAAG,kBAAkB;IACzF,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,MAAM,SAAS,GACb,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,KAAK,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QAChE,CAAC,CAAE,GAAG,CAAC,KAA2B,CAAC,IAAI,IAAI,EAAE;QAC7C,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;IAEpD,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzD,OAAO,2BAA2B,SAAS,GAAG,IAAI,qCAAqC,CAAC;IAC1F,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACjE,OAAO,wEAAwE,OAAO,GAAG,CAAC;IAC5F,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACnC,OAAO,4CAA4C,OAAO,GAAG,CAAC;IAChE,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACrE,OAAO,+CAA+C,OAAO,GAAG,CAAC;IACnE,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,wCAAwC,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACvF,OAAO,8DAA8D,CAAC;IACxE,CAAC;IACD,OAAO,8BAA8B,OAAO,0BAA0B,CAAC;AACzE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,IAAa;IAChE,MAAM,QAAQ,GAAG,QAAQ,MAAM,EAAE,CAAC;IAClC,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,MAAM,GAAI,IAA6B,CAAC,MAAM,CAAC;QACrD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE;YAAE,OAAO,MAAM,CAAC;QAC/D,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,6EAA6E;AAC7E,SAAS,wBAAwB,CAAC,KAAgB;IAChD,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;SAC5C,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;SACtC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAa;IAC5C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACjD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAIzB,CAAC;IAEF,mFAAmF;IACnF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAC9B,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE;QAChE,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,KAAK,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,OAAO,CAAC;IAE9D,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxF,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACxB,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACxB,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACxB,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAExB,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,GAAG,KAAK,oBAAoB,EAAE,QAAQ,EAAE,EAAE,CAAC;IAC5F,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,GAAG,KAAK,oBAAoB,EAAE,EAAE,CAAC;IAC9D,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,GAAG,KAAK,sBAAsB,EAAE,EAAE,CAAC;IAChE,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,GAAG,KAAK,qBAAqB,EAAE,EAAE,CAAC;IAC/D,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,GAAG,KAAK,yBAAyB,EAAE,EAAE,CAAC;IAEnE,gFAAgF;IAChF,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,EAAE,CAAC;QACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IACvE,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC"}
1
+ {"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/api/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAE7D,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,+EAA+E;AAC/E,kFAAkF;AAClF,8EAA8E;AAC9E,MAAM,cAAc,GAAG,iBAAiB,EAAE,CAAC;AAC3C,MAAM,aAAa,GAAG,sBAAsB,CAAC,cAAc,CAAC,CAAC;AAQ7D,MAAM,SAAS;IACb,KAAK,CAAC,OAAO,CACX,MAAc,EACd,IAAY,EACZ,IAAc,EACd,IAA6B;QAE7B,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC,MAAM,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE;YACxC,aAAa,EAAE,UAAU,QAAQ,EAAE;SACpC,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,IAAY,EACZ,IAAa;QAEb,OAAO,IAAI,CAAC,MAAM,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,IAAY;QACvB,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAa,EAAE,IAA6B;QACtE,OAAO,IAAI,CAAC,OAAO,CAAI,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,IAAa;QACtC,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,KAAK,CAAI,IAAY,EAAE,IAAa;QACxC,OAAO,IAAI,CAAC,OAAO,CAAI,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,MAAM,CAAI,IAAY;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAI,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CACjB,IAAY,EACZ,IAAc,EACd,IAA6B;QAE7B,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,GAAG,aAAa,EAAE,GAAG,IAAI,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,IAAI,EAAE,SAAS,IAAI,kBAAkB,CAAC;QACtD,MAAM,OAAO,GAA2B;YACtC,kBAAkB,EAAE,KAAK;YACzB,wBAAwB,EAAE,cAAc;YACxC,uBAAuB,EAAE,aAAa;YACtC,aAAa,EAAE,UAAU,QAAQ,EAAE;SACpC,CAAC;QAEF,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBACtB,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;aACrC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,EAAE,aAAa,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAC;QAC/C,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAM,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,IAAY,EACZ,IAAc,EACd,IAA6B;QAE7B,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,GAAG,aAAa,EAAE,GAAG,IAAI,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,IAAI,EAAE,SAAS,IAAI,kBAAkB,CAAC;QACtD,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,kBAAkB,EAAE,KAAK;YACzB,wBAAwB,EAAE,cAAc;YACxC,uBAAuB,EAAE,aAAa;YACtC,aAAa,EAAE,UAAU,QAAQ,EAAE;SACpC,CAAC;QAEF,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBACtB,MAAM;gBACN,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;aACrC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,EAAE,aAAa,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,0BAA0B,CAAC;QACnF,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,EAAE,CAAC;QAClE,MAAM,aAAa,GAAG,WAAW,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAE9D,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC7B,WAAW;YACX,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;SAClD,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,MAAM,CAClB,MAAc,EACd,IAAY,EACZ,IAAc,EACd,YAAqC,EACrC,SAAkB;QAElB,MAAM,GAAG,GAAG,GAAG,aAAa,EAAE,GAAG,IAAI,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,SAAS,IAAI,kBAAkB,CAAC;QAChD,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,kBAAkB,EAAE,KAAK;YACzB,wBAAwB,EAAE,cAAc;YACxC,uBAAuB,EAAE,aAAa;YACtC,GAAG,YAAY;SAChB,CAAC;QAEF,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBACtB,MAAM;gBACN,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;aACrC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,EAAE,aAAa,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAC;QAC/C,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAM,CAAC;IAClC,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,kBAAkB,CAAC,IAAc;QAC7C,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,8EAA8E;QAChF,CAAC;QACD,MAAM,GAAG,GAAa;YACpB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;SAChD,CAAC;QACF,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACxB,GAAG,CAAC,mBAAmB,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF;AAED,SAAS,oBAAoB,CAAC,GAAY,EAAE,OAAe,EAAE,SAAS,GAAG,kBAAkB;IACzF,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,MAAM,SAAS,GACb,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,KAAK,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QAChE,CAAC,CAAE,GAAG,CAAC,KAA2B,CAAC,IAAI,IAAI,EAAE;QAC7C,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,KAAK,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;IAEpD,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzD,OAAO,2BAA2B,SAAS,GAAG,IAAI,qCAAqC,CAAC;IAC1F,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACjE,OAAO,wEAAwE,OAAO,GAAG,CAAC;IAC5F,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACnC,OAAO,4CAA4C,OAAO,GAAG,CAAC;IAChE,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACrE,OAAO,+CAA+C,OAAO,GAAG,CAAC;IACnE,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,wCAAwC,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACvF,2EAA2E;QAC3E,yEAAyE;QACzE,mEAAmE;QACnE,OAAO,4KAA4K,CAAC;IACtL,CAAC;IACD,OAAO,8BAA8B,OAAO,0BAA0B,CAAC;AACzE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,IAAa;IAChE,MAAM,QAAQ,GAAG,QAAQ,MAAM,EAAE,CAAC;IAClC,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,MAAM,GAAI,IAA6B,CAAC,MAAM,CAAC;QACrD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE;YAAE,OAAO,MAAM,CAAC;QAC/D,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,6EAA6E;AAC7E,SAAS,wBAAwB,CAAC,KAAgB;IAChD,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;SAC5C,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;SACtC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAa;IAC5C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACjD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAIzB,CAAC;IAEF,mFAAmF;IACnF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAC9B,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE;QAChE,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,KAAK,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,OAAO,CAAC;IAE9D,MAAM,GAAG,GAAG,CAAC,CAAU,EAAsB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACxF,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACxB,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACxB,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACxB,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAExB,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,GAAG,KAAK,oBAAoB,EAAE,QAAQ,EAAE,EAAE,CAAC;IAC5F,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,GAAG,KAAK,oBAAoB,EAAE,EAAE,CAAC;IAC9D,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,GAAG,KAAK,sBAAsB,EAAE,EAAE,CAAC;IAChE,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,GAAG,KAAK,qBAAqB,EAAE,EAAE,CAAC;IAC/D,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,GAAG,KAAK,yBAAyB,EAAE,EAAE,CAAC;IAEnE,gFAAgF;IAChF,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,EAAE,CAAC;QACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IACvE,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC"}
package/dist/auth/token.js CHANGED
@@ -62,10 +62,20 @@ export async function getValidIdToken() {
62
62
  */
63
63
  export function refreshNetworkError(err) {
64
64
  const name = err instanceof Error ? err.name : "";
65
- const detail = (err instanceof Error ? err.message : String(err)).toLowerCase();
65
+ // Cert failures from undici surface the reason in err.cause.code (e.g.
66
+ // UNABLE_TO_VERIFY_LEAF_SIGNATURE), not the "fetch failed" message - so fold it in.
67
+ const causeCode = err instanceof Error && err.cause && typeof err.cause === "object"
68
+ ? (err.cause.code ?? "")
69
+ : "";
70
+ const detail = ((err instanceof Error ? err.message : String(err)) + " " + causeCode).toLowerCase();
66
71
  if (name === "TimeoutError" || detail.includes("timeout") || detail.includes("abort")) {
67
72
  return "Timed out refreshing your session. Check your connection, then run `graphit auth login` to sign in again.";
68
73
  }
74
+ // Feature #679: with NODE_USE_SYSTEM_CA dropped, bundled CA can't verify a corporate
75
+ // TLS-inspecting proxy's re-signed cert. Point the user at the opt-in escape hatch.
76
+ if (detail.includes("unable to get local issuer certificate") || detail.includes("cert")) {
77
+ return "TLS certificate error reaching the sign-in service. If you're behind a corporate proxy, set GRAPHIT_USE_SYSTEM_CA=1 to trust your system certificates.";
78
+ }
69
79
  return "Couldn't reach the sign-in service to refresh your session. Check your connection, or run `graphit auth login` to sign in again.";
70
80
  }
71
81
  //# sourceMappingURL=token.js.map
package/dist/auth/token.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/auth/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAErE,MAAM,kBAAkB,GAAG,6CAA6C,CAAC;AACzE,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,yCAAyC,CAAC;AAC3G,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,8EAA8E;AAC9E,iFAAiF;AACjF,sCAAsC;AACtC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAOlC,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;IACtC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,IACE,KAAK,CAAC,QAAQ;QACd,KAAK,CAAC,eAAe;QACrB,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,oBAAoB,EAChE,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IAC9D,CAAC;IAED,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,KAAK,CAChB,GAAG,kBAAkB,QAAQ,gBAAgB,EAAE,EAC/C;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,KAAK,CAAC,aAAa;aACnC,CAAC;YACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;SAChD,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,wEAAwE;QACxE,8EAA8E;QAC9E,4EAA4E;QAC5E,4EAA4E;QAC5E,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAK9B,CAAC;IAEF,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,SAAS,CAAC;IAE7C,MAAM,gBAAgB,CAAC;QACrB,GAAG,KAAK;QACR,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,KAAK,CAAC,aAAa;QACxD,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,eAAe,EAAE,MAAM;KACxB,CAAC,CAAC;IAEH,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAChF,IAAI,IAAI,KAAK,cAAc,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACtF,OAAO,2GAA2G,CAAC;IACrH,CAAC;IACD,OAAO,kIAAkI,CAAC;AAC5I,CAAC"}
1
+ {"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/auth/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAErE,MAAM,kBAAkB,GAAG,6CAA6C,CAAC;AACzE,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,yCAAyC,CAAC;AAC3G,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,8EAA8E;AAC9E,iFAAiF;AACjF,sCAAsC;AACtC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAOlC,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;IACtC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,IACE,KAAK,CAAC,QAAQ;QACd,KAAK,CAAC,eAAe;QACrB,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,oBAAoB,EAChE,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IAC9D,CAAC;IAED,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,KAAK,CAChB,GAAG,kBAAkB,QAAQ,gBAAgB,EAAE,EAC/C;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,KAAK,CAAC,aAAa;aACnC,CAAC;YACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;SAChD,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,wEAAwE;QACxE,8EAA8E;QAC9E,4EAA4E;QAC5E,4EAA4E;QAC5E,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAK9B,CAAC;IAEF,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,SAAS,CAAC;IAE7C,MAAM,gBAAgB,CAAC;QACrB,GAAG,KAAK;QACR,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,KAAK,CAAC,aAAa;QACxD,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,eAAe,EAAE,MAAM;KACxB,CAAC,CAAC;IAEH,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;AAC5D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,MAAM,IAAI,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,uEAAuE;IACvE,oFAAoF;IACpF,MAAM,SAAS,GACb,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,KAAK,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QAChE,CAAC,CAAC,CAAE,GAAG,CAAC,KAA2B,CAAC,IAAI,IAAI,EAAE,CAAC;QAC/C,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,GAAG,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;IACpG,IAAI,IAAI,KAAK,cAAc,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACtF,OAAO,2GAA2G,CAAC;IACrH,CAAC;IACD,qFAAqF;IACrF,oFAAoF;IACpF,IAAI,MAAM,CAAC,QAAQ,CAAC,wCAAwC,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACzF,OAAO,wJAAwJ,CAAC;IAClK,CAAC;IACD,OAAO,kIAAkI,CAAC;AAC5I,CAAC"}
package/dist/ca-guard.d.ts ADDED
@@ -0,0 +1 @@
1
+ export {};
package/dist/ca-guard.js ADDED
@@ -0,0 +1,41 @@
1
+ // Feature #679: NODE_USE_SYSTEM_CA=1 (injected by some agent runtimes, e.g. Claude
2
+ // Code, for corporate-proxy compatibility) makes Node read the OS trust store for
3
+ // TLS CA verification. On macOS that means the Keychain (Security framework), which
4
+ // the Claude Code command sandbox blocks - producing a native crash (exit 139,
5
+ // "SecItemCopyMatching failed -67674") on the first networked command. The variable
6
+ // is read once at Node startup and cannot be unset from JS afterward, so we re-exec
7
+ // a single child with it removed BEFORE any TLS-capable module loads.
8
+ //
9
+ // This module MUST be imported first in index.ts: ESM evaluates imports in source
10
+ // order, so an inline guard in index.ts's body would run after the import graph has
11
+ // already been evaluated (and could already have touched the CA store).
12
+ //
13
+ // Graphit's API uses a public CA already in Node's bundled Mozilla store, so bundled
14
+ // CA is sufficient. Users genuinely behind a corporate TLS-inspecting proxy opt back
15
+ // into the system trust store with GRAPHIT_USE_SYSTEM_CA=1.
16
+ import { spawnSync } from "node:child_process";
17
+ const optedIntoSystemCa = Boolean(process.env.GRAPHIT_USE_SYSTEM_CA);
18
+ const alreadyReexeced = Boolean(process.env.__GRAPHIT_CA_REEXEC);
19
+ if (process.env.NODE_USE_SYSTEM_CA && !optedIntoSystemCa && !alreadyReexeced) {
20
+ const childEnv = { ...process.env, __GRAPHIT_CA_REEXEC: "1" };
21
+ delete childEnv.NODE_USE_SYSTEM_CA;
22
+ // process.argv = [execPath, scriptPath, ...userArgs]; slice(1) keeps the script
23
+ // path + user args so the child re-runs the same command, sans the toxic var.
24
+ const result = spawnSync(process.execPath, process.argv.slice(1), {
25
+ stdio: "inherit",
26
+ env: childEnv,
27
+ });
28
+ // Spawn itself failed (e.g. ENOENT): surface it rather than falling through with
29
+ // NODE_USE_SYSTEM_CA still set, which would just crash anyway.
30
+ if (result.error) {
31
+ throw result.error;
32
+ }
33
+ // spawnSync sets status=null + signal when the child dies by signal. Mirror the
34
+ // signal so Ctrl-C during an interactive command (e.g. `auth login`) yields the
35
+ // right exit semantics to callers/CI instead of a misleading exit 0.
36
+ if (result.signal) {
37
+ process.kill(process.pid, result.signal);
38
+ }
39
+ process.exit(result.status ?? 1);
40
+ }
41
+ //# sourceMappingURL=ca-guard.js.map
package/dist/ca-guard.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"ca-guard.js","sourceRoot":"","sources":["../src/ca-guard.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,kFAAkF;AAClF,oFAAoF;AACpF,+EAA+E;AAC/E,oFAAoF;AACpF,oFAAoF;AACpF,sEAAsE;AACtE,EAAE;AACF,kFAAkF;AAClF,oFAAoF;AACpF,wEAAwE;AACxE,EAAE;AACF,qFAAqF;AACrF,qFAAqF;AACrF,4DAA4D;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,MAAM,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;AACrE,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;AAEjE,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,CAAC,iBAAiB,IAAI,CAAC,eAAe,EAAE,CAAC;IAC7E,MAAM,QAAQ,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE,CAAC;IACjF,OAAO,QAAQ,CAAC,kBAAkB,CAAC;IAEnC,gFAAgF;IAChF,8EAA8E;IAC9E,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QAChE,KAAK,EAAE,SAAS;QAChB,GAAG,EAAE,QAAQ;KACd,CAAC,CAAC;IAEH,iFAAiF;IACjF,+DAA+D;IAC/D,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,MAAM,CAAC,KAAK,CAAC;IACrB,CAAC;IACD,gFAAgF;IAChF,gFAAgF;IAChF,qEAAqE;IACrE,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;AACnC,CAAC"}
package/dist/index.d.ts CHANGED
@@ -1,2 +1,2 @@
1
1
  #!/usr/bin/env node
2
- export {};
2
+ import "./ca-guard.js";
package/dist/index.js CHANGED
@@ -1,4 +1,8 @@
1
1
  #!/usr/bin/env node
2
+ // Feature #679: MUST be the first import. It re-execs without NODE_USE_SYSTEM_CA
3
+ // before any TLS-capable module loads, so the macOS keychain is never touched under
4
+ // the Claude Code sandbox (see ca-guard.ts for the full rationale).
5
+ import "./ca-guard.js";
2
6
  import { Command } from "commander";
3
7
  import { registerAuthCommands } from "./commands/auth.js";
4
8
  import { registerKBCommands } from "./commands/kb.js";
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,4BAA4B,EAC5B,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACnC,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC9C,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC9C,MAAM,qBAAqB,GAAG,cAAc,IAAI,CAAC,IAAI,cAAc,KAAK,cAAc,GAAG,CAAC,CAAC;AAE3F,OAAO;KACJ,IAAI,CAAC,SAAS,CAAC;KACf,WAAW,CAAC,oEAAoE,CAAC;KACjF,OAAO,CAAC,iBAAiB,EAAE,CAAC;KAC5B,MAAM,CAAC,mBAAmB,EAAE,iDAAiD,EAAE,MAAM,CAAC,CAAC;AAE1F,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,kBAAkB,CAAC,OAAO,CAAC,CAAC;AAC5B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,kBAAkB,CAAC,OAAO,CAAC,CAAC;AAC5B,yBAAyB,CAAC,OAAO,CAAC,CAAC;AACnC,yBAAyB,CAAC,OAAO,CAAC,CAAC;AACnC,0BAA0B,CAAC,OAAO,CAAC,CAAC;AACpC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAE9B,IAAI,CAAC,qBAAqB,EAAE,CAAC;IAC3B,4BAA4B,EAAE,CAAC;IAC/B,iBAAiB,EAAE,CAAC;IACpB,0BAA0B,EAAE,CAAC;AAC/B,CAAC;AACD,OAAO,CAAC,KAAK,EAAE,CAAC;AAChB,mBAAmB,EAAE,CAAC"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,iFAAiF;AACjF,oFAAoF;AACpF,oEAAoE;AACpE,OAAO,eAAe,CAAC;AAEvB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,4BAA4B,EAC5B,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACnC,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC9C,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC9C,MAAM,qBAAqB,GAAG,cAAc,IAAI,CAAC,IAAI,cAAc,KAAK,cAAc,GAAG,CAAC,CAAC;AAE3F,OAAO;KACJ,IAAI,CAAC,SAAS,CAAC;KACf,WAAW,CAAC,oEAAoE,CAAC;KACjF,OAAO,CAAC,iBAAiB,EAAE,CAAC;KAC5B,MAAM,CAAC,mBAAmB,EAAE,iDAAiD,EAAE,MAAM,CAAC,CAAC;AAE1F,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,kBAAkB,CAAC,OAAO,CAAC,CAAC;AAC5B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,kBAAkB,CAAC,OAAO,CAAC,CAAC;AAC5B,yBAAyB,CAAC,OAAO,CAAC,CAAC;AACnC,yBAAyB,CAAC,OAAO,CAAC,CAAC;AACnC,0BAA0B,CAAC,OAAO,CAAC,CAAC;AACpC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAE9B,IAAI,CAAC,qBAAqB,EAAE,CAAC;IAC3B,4BAA4B,EAAE,CAAC;IAC/B,iBAAiB,EAAE,CAAC;IACpB,0BAA0B,EAAE,CAAC;AAC/B,CAAC;AACD,OAAO,CAAC,KAAK,EAAE,CAAC;AAChB,mBAAmB,EAAE,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@graphit/cli",
3
- "version": "0.2.68",
3
+ "version": "0.2.73",
4
4
  "description": "Graphit CLI - Build custom dashboards from any AI coding assistant",
5
5
  "repository": {
6
6
  "type": "git",
package/skills/graphit/SKILL.md CHANGED
@@ -2,7 +2,7 @@
2
2
  name: graphit
3
3
  description: >-
4
4
  Use Graphit for ANY question about the user's business or product data: metrics, KPIs, revenue, retention, spend, users, cohorts, funnels, trends, comparisons, "why did X change", "how are we doing on Y", analysis, reports, or dashboards. Activate even when the user does not say "Graphit" or name any tool: if someone wants to understand their numbers, this is the tool. Graphit answers through a governed semantic layer (computed the team's way, reusable and safe to share) and delivers the answer as a fast cached-data query or a hand-authored interactive HTML dashboard, and can create the metrics, dimensions, and rules an answer needs. Prefer Graphit over hand-rolled one-off analysis whenever the data is, or could be, the user's business data. Skip only for pure software tasks (code, logs, config, infra) or data with nothing to do with the user's business.
5
- skill_version: "0.2.68"
5
+ skill_version: "0.2.73"
6
6
  ---
7
7
 
8
8
  <!-- SIZE EXEMPTION (SKILL.md): standard hard limit 12,288 chars, exempted ceiling 25,600. This router always-loads the collaboration/pace spine (brainstorm, ask-user, present-result, plan-next), the hard constraints + scope gate, the investigation loop, and the generated command table (between the COMMANDS markers, written by scripts/generate-commands-doc.mjs) - all needed every turn, so they cannot defer to a reference. The marker sits after the YAML frontmatter so the loader and sync-plugin-version.mjs still parse it. Reviewed 2026-06-25. -->
@@ -141,7 +141,7 @@ Read the one that matches what you are doing now. Do not preload them. Exact com
141
141
 
142
142
  ## Commands
143
143
 
144
- Graphit is one CLI, but how you invoke it depends on your environment. On Claude Code the plugin provides a `graphit` wrapper, so `graphit <command>` runs the current CLI. On Codex, Cursor, a terminal, or CI there is no `graphit` wrapper - invoke the CLI explicitly with `npx -y @graphit/cli@0.2.68 <command>` (a stamped version, kept current automatically by the build), or pin an exact one - `npx -y @graphit/cli@<exact> <command>` - for a reproducible run. The table below is the always-loaded command map, generated from the CLI itself, so it is the source of truth for which commands, subcommands, and flags exist. For exact flag values and full descriptions, run `graphit <command> --help` - never guess a flag.
144
+ Graphit is one CLI, but how you invoke it depends on your environment. On Claude Code the plugin provides a `graphit` wrapper, so `graphit <command>` runs the current CLI. On Codex, Cursor, a terminal, or CI there is no `graphit` wrapper - invoke the CLI explicitly with `npx -y @graphit/cli@0.2.73 <command>` (a stamped version, kept current automatically by the build), or pin an exact one - `npx -y @graphit/cli@<exact> <command>` - for a reproducible run. The table below is the always-loaded command map, generated from the CLI itself, so it is the source of truth for which commands, subcommands, and flags exist. For exact flag values and full descriptions, run `graphit <command> --help` - never guess a flag.
145
145
 
146
146
  <!-- COMMANDS:START -->
147
147
 
package/skills/graphit/VERSION.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
2
  "package": "@graphit/cli",
3
- "version": "0.2.68",
3
+ "version": "0.2.73",
4
4
  "source": "cli/package.json"
5
5
  }
package/skills/graphit/references/chart-patterns.md CHANGED
@@ -1,6 +1,6 @@
1
1
  # Chart Patterns
2
2
 
3
- The chart types documented below are the native `graphit.chart()` types. Anything not listed here (treemap, sankey, maps, box) is hand-rolled SVG - see `chart-selection.md` for the native-vs-hand-rolled split. "Native" here means only that `graphit.chart()` draws it; a hand-rolled SVG chart is equally first-class - same 3-dot menu, data source, and provenance - once wrapped in `data-graphit-*`. All data comes from `graphit.resolve()` - never embed static data.
3
+ The chart types documented below are the standard `graphit.graph()` types (set via `config.type`). Anything not listed here (treemap, sankey, maps, box) you draw yourself - as a `type:'custom'` graph (responsive + themed, see below) or raw hand-rolled SVG; see `chart-selection.md` for the split. A graph you draw is equally first-class - same 3-dot menu, data source, and provenance - once wrapped in `data-graphit-*`. All data comes from `graphit.resolve()` - never embed static data.
4
4
 
5
5
  **NEVER use `<canvas>`.** Canvas produces blurry charts inside the sandboxed iframe due to DPI scaling issues.
6
6
 
@@ -47,11 +47,28 @@ Config: `y`, `width` (default 120), `height` (default 32), `label`, `showValue`
47
47
  ## Value formatting
48
48
  `valueFormat` (charts), `format` (`kpi`/`gauge`), and `columnFormats` (`graphit.table`, mapping column name -> format) all take `"currency"`, `"percent"`, or `"number"`. **`"percent"` only appends `%` - it does NOT multiply by 100.** A 0-1 ratio renders as `0.42%`, not `42%`; multiply ratios/rates by 100 in SQL (`* 100.0 ... AS x_pct`) so the value is already 0-100. Table columns without a `columnFormats` entry render raw.
49
49
 
50
+ ## Bespoke responsive SVG (`type: 'custom'`)
51
+
52
+ For a custom look, draw your own SVG through the same entry: `graphit.graph(el, { type: 'custom', draw: (ctx) => marks })`. Return the INNER marks only (`<rect>`/`<path>`/`<text>`/`<g>`) as a string; the runtime wraps them in `<svg viewBox="0 0 W H">` sized to the container, so 1 unit = 1 CSS pixel and text stays one size at any width. Unlike raw hand-rolled `<svg>`, a custom graph is responsive and re-themes on dark for free.
53
+
54
+ `ctx` provides: `ctx.width`/`ctx.height` (px; height from `config.height`, default 280; width = measured container); token colors (dark-free via cascade, prefer these) `ctx.accent`, `ctx.fg`, `ctx.fgMuted`, `ctx.fgSubtle`, `ctx.border`, `ctx.surface`, `ctx.surfaceSunken`, `ctx.palette`, `ctx.color(i)` (cycles palette, honors `config.colors`); `ctx.resolved.*` (same names + `ctx.resolved.color(i)` as hex - use ONLY to compute/mix colors); helpers `ctx.fmt(v, kind)`, `ctx.esc(v)`, `ctx.num(v)`, `ctx.clamp(n, min, max)`, `ctx.safeColor(value, fallback)`.
55
+
56
+ Escaping is yours: data-derived text through `ctx.esc()`, author colors through `ctx.safeColor()` - the runtime does not auto-escape your marks. Opt out per concern with `responsive: false` (render once) or `themed: false` (no dark re-draw).
57
+
58
+ ```js
59
+ const r = await graphit.resolve({ sql, dataSourceId: "ORDERS_DS", target: "#chart" });
60
+ graphit.graph("#chart", { type: "custom", draw: (ctx) => r.data.map(function (row, i) {
61
+ var h = ctx.num(row.value) / 100 * ctx.height, x = (ctx.width / r.data.length) * i;
62
+ return '<rect x="' + x + '" y="' + (ctx.height - h) + '" width="22" height="' + h +
63
+ '" fill="' + ctx.color(i) + '"><title>' + ctx.esc(row.label) + '</title></rect>';
64
+ }).join("") });
65
+ ```
66
+
50
67
  ## Saved templates
51
68
 
52
69
  Templates are reusable chart components saved to the org's KB. At dashboard load, the SDK fetches the org's template bundle and registers them alongside built-in types.
53
70
 
54
- **Usage:** `graphit.TEMPLATE_NAME(el, {data, value: 'revenue', label: 'Revenue'})` or via `graphit.chart(el, {type: 'TEMPLATE_NAME', ...})`.
71
+ **Usage:** `graphit.TEMPLATE_NAME(el, {data, value: 'revenue', label: 'Revenue'})` or via `graphit.graph(el, {type: 'TEMPLATE_NAME', ...})`.
55
72
 
56
73
  Templates are org-specific - they exist only when users have saved them. The agent's context provider lists available templates each turn. Use `list_templates()` to discover them and `get_template(name)` to read the render code.
57
74
 
@@ -59,28 +76,14 @@ Templates are org-specific - they exist only when users have saved them. The age
59
76
 
60
77
  Use theme CSS variables for all structural colors so charts adapt to light and dark mode. The full token table and usage rules live in `graphit-style.md` - that is the single source; do not re-list tokens here. Chart series colors come from the runtime palette automatically.
61
78
 
62
- ## Tooltip pattern (for hand-rolled charts)
79
+ ## Tooltips (hand-rolled and custom SVG)
63
80
 
64
- Runtime charts use `<title>` elements for native browser tooltips. For hand-rolled charts, add ONE shared tooltip div and always escape user data with a manual HTML escape function before passing to `showTooltip()`:
65
-
66
- ```html
67
- <div id="tooltip" style="position:fixed;pointer-events:none;z-index:100;
68
- background:var(--graphit-surface-raised);color:var(--graphit-fg);
69
- border:1px solid var(--graphit-border);border-radius:8px;
70
- padding:10px 14px;font-size:13px;line-height:1.5;
71
- box-shadow:0 4px 12px rgba(0,0,0,0.15);opacity:0;transition:opacity 0.15s;
72
- max-width:240px"></div>
73
- ```
81
+ Standard types and `type:'custom'` graphs get native browser tooltips from `<title>` children (escape the text with `ctx.esc()`). For a styled tooltip on hand-rolled SVG, add ONE shared tooltip div (`position:fixed; pointer-events:none; opacity:0`, themed with `var(--graphit-*)` tokens) and ALWAYS HTML-escape user data first:
74
82
 
75
83
  ```js
76
- var tooltip = document.getElementById('tooltip');
77
- function showTooltip(e, html) {
78
- tooltip.innerHTML = html;
79
- tooltip.style.opacity = '1';
80
- var tx = Math.min(e.clientX + 12, window.innerWidth - 260);
81
- var ty = e.clientY - tooltip.offsetHeight - 8;
82
- tooltip.style.left = tx + 'px';
83
- tooltip.style.top = (ty < 4 ? e.clientY + 16 : ty) + 'px';
84
- }
85
- function hideTooltip() { tooltip.style.opacity = '0'; }
84
+ var tip = document.getElementById('tooltip');
85
+ function showTooltip(e, html) { tip.innerHTML = html; tip.style.opacity = '1';
86
+ tip.style.left = Math.min(e.clientX + 12, window.innerWidth - 260) + 'px';
87
+ tip.style.top = (e.clientY - tip.offsetHeight - 8) + 'px'; }
88
+ function hideTooltip() { tip.style.opacity = '0'; }
86
89
  ```
package/skills/graphit/references/chart-selection.md CHANGED
@@ -17,22 +17,22 @@ When ambiguous, propose 2-3 options and ask the user. Do not guess.
17
17
 
18
18
  ## Full Chart Type Table
19
19
 
20
- `graphit.chart()` renders only the **native** types below and throws `Unsupported graphit.chart type` on anything else. The iframe still lets you draw anything with inline SVG/CSS, so the **hand-rolled** shapes are fully buildable - just not through `graphit.chart()` (see `chart-patterns.md`). Never pass a hand-rolled type name to `graphit.chart()`. "Native" and "hand-rolled" describe only which draw function you call, not platform status: both become equally first-class - same 3-dot menu, data source, and provenance - once wrapped in `data-graphit-*`, so a hand-rolled chart is never a lesser citizen.
20
+ `graphit.graph()` renders the **standard** types below and throws an `unknown type` error on anything that is not a standard type, a saved template, or `'custom'`. The iframe still lets you draw anything: pass `type:'custom'` with a `draw(ctx)` function (responsive + themed, see `chart-patterns.md`) or hand-roll inline SVG/CSS. The **hand-rolled** shapes below are drawn that way, never passed as a standard type name. "Standard" and "hand-rolled" describe only which draw path you use, not platform status: both become equally first-class - same 3-dot menu, data source, and provenance - once wrapped in `data-graphit-*`, so a graph you draw is never a lesser citizen.
21
21
 
22
22
  | Data shape | Chart type | Render with | Columns |
23
23
  |---|---|---|---|
24
- | Time series | line / area | `graphit.chart` (native) | 1 temporal + 1 numeric |
25
- | Categories | bar | `graphit.chart` (native) | 1 categorical + 1 numeric |
26
- | Long category labels | horizontal-bar | `graphit.chart` (native) | 1 categorical + 1 numeric |
27
- | Part-whole (max 5 slices) | donut / pie | `graphit.chart` (native) | 1 categorical + 1 numeric |
28
- | Single metric | KPI card | `graphit.kpi` (native) | 1 numeric |
29
- | Stages | funnel | `graphit.chart` (native) | 1 categorical + 1 numeric |
30
- | Target / progress | gauge | `graphit.chart` (native) | 1 numeric |
31
- | Matrix (unpivoted) | heatmap | `graphit.chart` (native) | 2 categorical + 1 numeric |
32
- | Correlation | scatter | `graphit.chart` (native) | 2 numeric |
33
- | 3 variables | bubble | `graphit.chart` (native) | 3 numeric |
34
- | Inline trend | sparkline | `graphit.chart` (native) | 1 numeric series |
35
- | Detail / raw data | table | `graphit.table` (native) | any columns |
24
+ | Time series | line / area | `graphit.graph` (standard) | 1 temporal + 1 numeric |
25
+ | Categories | bar | `graphit.graph` (standard) | 1 categorical + 1 numeric |
26
+ | Long category labels | horizontal-bar | `graphit.graph` (standard) | 1 categorical + 1 numeric |
27
+ | Part-whole (max 5 slices) | donut / pie | `graphit.graph` (standard) | 1 categorical + 1 numeric |
28
+ | Single metric | KPI card | `graphit.kpi` (standard) | 1 numeric |
29
+ | Stages | funnel | `graphit.graph` (standard) | 1 categorical + 1 numeric |
30
+ | Target / progress | gauge | `graphit.graph` (standard) | 1 numeric |
31
+ | Matrix (unpivoted) | heatmap | `graphit.graph` (standard) | 2 categorical + 1 numeric |
32
+ | Correlation | scatter | `graphit.graph` (standard) | 2 numeric |
33
+ | 3 variables | bubble | `graphit.graph` (standard) | 3 numeric |
34
+ | Inline trend | sparkline | `graphit.graph` (standard) | 1 numeric series |
35
+ | Detail / raw data | table | `graphit.table` (standard) | any columns |
36
36
  | Hierarchy | treemap | hand-rolled SVG | 1 categorical + 1 numeric |
37
37
  | Flows | sankey | hand-rolled SVG | 2 categorical + 1 numeric |
38
38
  | Geographic | map | hand-rolled SVG | region or lat/lng + 1 numeric |
@@ -56,7 +56,7 @@ Position > length > angle > area > color.
56
56
  | KPI vs target | big-number + sparkline | gauge (unbounded) |
57
57
  | 2D matrix / cohort | heatmap | bar with 100+ |
58
58
 
59
- The native `graphit.chart` first choices here are line, bar, stacked-bar, scatter, bubble, funnel, heatmap, gauge, and sparkline. Treemap, histogram, and box are hand-rolled SVG (see the table above) - draw them, don't pass them to `graphit.chart()`.
59
+ The standard `graphit.graph` first choices here are line, bar, stacked-bar, scatter, bubble, funnel, heatmap, gauge, and sparkline. Treemap, histogram, and box are hand-rolled SVG (see the table above) - draw them via `type:'custom'` or inline SVG, never pass them as a standard type name.
60
60
 
61
61
  ## Cardinality Guards
62
62
 
package/skills/graphit/references/filters-advanced.md CHANGED
@@ -54,7 +54,7 @@ graphit.bind('#rev', {
54
54
  dataSourceId: 'ORDERS',
55
55
  params: () => ({ start_date: dr.start, end_date: dr.end }),
56
56
  deps: dr.deps,
57
- render: (r, el) => graphit.chart(el, { type: 'area', data: r.data, x: 'day', y: 'rev' }),
57
+ render: (r, el) => graphit.graph(el, { type: 'area', data: r.data, x: 'day', y: 'rev' }),
58
58
  })
59
59
  ```
60
60
 
package/skills/graphit/references/filters.md CHANGED
@@ -54,14 +54,14 @@ graphit.bind(document.getElementById('revenue-chart'), {
54
54
  params: () => ({ country: graphit.state.get('country') }),
55
55
  deps: ['country'], // state keys that trigger re-resolve (inferred from params if omitted)
56
56
  render: (result, el) => {
57
- graphit.chart(el, { type: 'line', data: result.data, x: 'date', y: 'revenue' });
57
+ graphit.graph(el, { type: 'line', data: result.data, x: 'date', y: 'revenue' });
58
58
  }
59
59
  });
60
60
  ```
61
61
 
62
62
  - Runs once immediately, then re-runs on any dep change
63
63
  - Multi-key changes (e.g. a saved view applying 3 filters) debounce into one re-resolve per element
64
- - `render` is your code - call `graphit.chart`, `graphit.table`, or hand-roll SVG/CSS
64
+ - `render` is your code - call `graphit.graph`, `graphit.table`, or hand-roll SVG/CSS
65
65
 
66
66
  ## Safe Parameter Binding (`:name` syntax)
67
67
 
@@ -110,7 +110,7 @@ One control, wired to one reactive chart. The `<select>` is your own markup; `bi
110
110
  params: () => ({ region: region.get() }),
111
111
  deps: ['region'],
112
112
  render: (result, el) => {
113
- graphit.chart(el, { type: 'area', data: result.data, x: 'month', y: 'revenue', valueFormat: 'currency' });
113
+ graphit.graph(el, { type: 'area', data: result.data, x: 'month', y: 'revenue', valueFormat: 'currency' });
114
114
  }
115
115
  });
116
116
  </script>
package/skills/graphit/references/presentations.md CHANGED
@@ -67,7 +67,7 @@ The slide deck includes built-in navigation:
67
67
 
68
68
  ## Live Data Inside Slides
69
69
 
70
- `graphit.resolve()` and `graphit.chart/table/kpi` work inside slides. All resolve calls fire on page load (cached queries are fast). Charts render into their target elements regardless of which slide is visible.
70
+ `graphit.resolve()` and `graphit.graph/table/kpi` work inside slides. All resolve calls fire on page load (cached queries are fast). Charts render into their target elements regardless of which slide is visible.
71
71
 
72
72
  ```js
73
73
  // Slide with live entities
@@ -94,7 +94,7 @@ graphit.resolve({
94
94
  dataSourceId: "MARKETING_UA_DS",
95
95
  target: "#chart1"
96
96
  }).then(function(r) {
97
- graphit.chart("#chart1", { type: "bar", data: r.data, x: "MEDIA_SOURCE", y: "spend", valueFormat: "currency" });
97
+ graphit.graph("#chart1", { type: "bar", data: r.data, x: "MEDIA_SOURCE", y: "spend", valueFormat: "currency" });
98
98
  });
99
99
  ```
100
100
 
package/skills/graphit/references/runtime.md CHANGED
@@ -1,24 +1,14 @@
1
1
  <!--
2
2
  SIZE EXEMPTION (reference file)
3
3
  Hard limit: 7,168 chars | Exempted ceiling: 14,336 chars
4
- Current: ~12,990 chars (content) - intentionally over the base reference limit.
5
- Rationale: runtime.md is the consolidated build-time data + entity contract. Its core - the live-data API, the data-graphit-* entity contract, the first-paint loading state, the helper index, and the canonical example - is a single co-load unit: building one live element needs all of it together, so by the co-load test (split a reference only where the agent needs one part without the other) it cannot be split without creating refs that always load together, which the test forbids. The one use-case-clean seam (cache-friendly resolve SQL + the rate-limit budget, needed only for interactive or large dashboards) was deliberately kept inline to preserve the single authoritative contract. This ref loads only on HTML-deliverable turns (just-in-time, not every turn), so the cache cost is bounded.
6
- Reviewed: 2026-06-23
7
- Next review: 2026-09-17
4
+ Current: ~14,325 chars - intentionally over the base reference limit.
5
+ Rationale: the consolidated build-time data + entity contract (live-data API, data-graphit-* entity contract, first-paint state, helper index, canonical example) - one co-load unit the co-load test forbids splitting. Loads only on HTML-deliverable turns (just-in-time, not every turn), so cache cost is bounded.
6
+ Reviewed: 2026-06-29
7
+ Next review: 2026-09-29
8
8
  -->
9
9
  # Canvas Runtime: Live Data and the Entity Contract
10
10
 
11
- Consult when authoring the dashboard HTML and wiring its data. This is the build-time contract: how the iframe fetches live data, how every visible element becomes a platform entity, how the page paints before data arrives, and how to shape resolve SQL so filter changes stay instant. Design-system tokens and layout CSS live in `graphit-style.md`; this file owns the data wiring.
12
-
13
- ## Contents
14
-
15
- - The live-data API (`graphit.resolve`)
16
- - The entity contract (`data-graphit-*`)
17
- - First-paint loading state
18
- - Cache-friendly resolve SQL
19
- - Rate-limit budget
20
- - Helper index (chart / table / kpi / presentation / filters)
21
- - Canonical entity with live data
11
+ Consult when authoring the dashboard HTML and wiring its data: how the iframe fetches live data, how every visible element becomes a platform entity, how the page paints before data arrives, and how to shape resolve SQL so filter changes stay instant. Design-system tokens and layout CSS live in `graphit-style.md`; this file owns the data wiring.
22
12
 
23
13
  ## The live-data API
24
14
 
@@ -36,18 +26,18 @@ const result = await graphit.resolve({
36
26
 
37
27
  - `dataSourceId` is the data source name (the same table you SELECT FROM); its id or a unique id-prefix also works.
38
28
  - `target` (optional, a CSS selector or element) shows a blur and spinner overlay while loading and removes it on completion.
39
- - `targetEntityIds` (optional, `string[]`) - the `data-graphit-id`s of OTHER graphs this one result also renders into; the platform records the live filtered query for each so their details panels reflect filters, not just the `target` graph.
40
- - `sourceEntityId` (optional) - the `data-graphit-id` of the graph that owns this query, for a `target`-less resolve that feeds several graphs (pair with `targetEntityIds`).
41
- - `maxRows` (optional) defaults to **10,000 rows** and may be raised up to a cap of **50,000 rows**. A dashboard query should aggregate to a chartable grain well under the default; reach for a higher value only for a genuine row-level export, and never above the cap.
29
+ - `targetEntityIds` (optional, `string[]`) - `data-graphit-id`s of OTHER graphs this result also renders into, so each one's details panel reflects filters (not just `target`).
30
+ - `sourceEntityId` (optional) - the graph that owns a `target`-less resolve feeding several graphs (pair with `targetEntityIds`).
31
+ - `maxRows` (optional) defaults to **10,000**, capped at **50,000**. Aggregate to a chartable grain well under the default; raise it only for a genuine row-level export, never above the cap.
42
32
  - `result.data` is an array of row objects you render however you want.
43
33
 
44
- CRITICAL: use KB reference syntax (`{{metric:NAME}}`, `{{dim:NAME}}`) inside the resolve `sql` whenever a KB asset exists - the server expands it at query time, which produces the governed trust tier. See `governance.md` for the syntax and trust tiers. The canonical example at the end of this file shows a resolve call with reference syntax in context.
34
+ CRITICAL: use KB reference syntax (`{{metric:NAME}}`, `{{dim:NAME}}`) inside the resolve `sql` whenever a KB asset exists - the server expands it at query time, which produces the governed trust tier. See `governance.md` for the syntax and trust tiers.
45
35
 
46
- Error handling: `graphit.resolve()` rejects on timeout (120s), bad SQL, or an invalid data source ID. Wrap calls in try/catch and show a user-visible error message in the target element on failure. Verify the SQL returns data via the CLI before embedding it in HTML.
36
+ Error handling: `graphit.resolve()` rejects on timeout (120s), bad SQL, or an invalid data source ID. Wrap calls in try/catch and show a user-visible error in the target element on failure. Verify the SQL returns data via the CLI before embedding it.
47
37
 
48
38
  ## The entity contract
49
39
 
50
- Every visible element - chart, KPI card, table, text section - must be wrapped so the platform can see it. Without `data-graphit-*` attributes the element is invisible to the platform: no click info, no @ mentions, no KB provenance. Wrapping is also what gives the element its 3-dot menu (hover, top-right) and its details panel - data source, governed SQL, KB lineage, and live results: a hand-rolled chart and a `graphit.chart()` chart are equally first-class once wrapped, with the same 3-dot menu and inspection a graph built in the Graphit UI has. Never rebuild a custom dashboard as native graphs to gain the menu or the data sources; just add the wrapper. Each wrapped element needs ALL FOUR attributes:
40
+ Every visible element - chart, KPI card, table, text section - must be wrapped so the platform can see it. Without `data-graphit-*` attributes the element is invisible: no click info, no @ mentions, no KB provenance. Wrapping also gives the element its 3-dot menu (hover, top-right) and details panel - data source, governed SQL, KB lineage, live results. A graph you draw and a standard `graphit.graph()` chart are equally first-class once wrapped; never rebuild a custom dashboard as native graphs to gain the menu or data sources - just add the wrapper. Each wrapped element needs ALL FOUR attributes:
51
41
 
52
42
  ```html
53
43
  <div data-graphit-id="revenue-trend"
@@ -135,19 +125,20 @@ If you hit the limit, the API returns a "Too many requests" error with a retry-a
135
125
 
136
126
  ## Helper index
137
127
 
138
- You have full creative freedom: build charts with inline SVG, CSS, and HTML tables for full control. The iframe also provides convenience helpers for quick standard output. These are shortcuts, not requirements.
128
+ You have full creative freedom: draw with `type:'custom'` or inline SVG/CSS/HTML tables for full control. The helpers below are convenience shortcuts for quick standard output, not requirements.
139
129
 
140
130
  | Helper | What it renders | Depth |
141
131
  |---|---|---|
142
- | `graphit.chart(el, {type, data, x, y, ...})` | A native chart of the given `type` | `chart-patterns.md` (per-type config) |
132
+ | `graphit.graph(el, {type, data, x, y, ...})` | A standard chart of the given `type` | `chart-patterns.md` (per-type config) |
133
+ | `graphit.graph(el, {type:'custom', draw})` | Bespoke SVG you draw via `(ctx)=>marks` - responsive + dark-themed for free | `chart-patterns.md` (ctx + escape contract) |
143
134
  | `graphit.table(el, {data, columns?, columnFormats?})` | A styled HTML table; `columnFormats` maps a column name to `"currency"` / `"percent"` / `"number"` | `chart-patterns.md` |
144
135
  | `graphit.kpi(el, {value, label?, format?})` | A KPI card with an optional delta | `chart-patterns.md` |
145
136
  | `graphit.presentation(el)` | A full-screen slide deck builder | `presentations.md` |
146
137
  | `graphit.filter / param / dateRange / cascade / bind` | Headless interactivity (zero imposed markup) | `filters.md`, `filters-advanced.md` |
147
138
 
148
- **Native `graphit.chart` types:** `"bar"`, `"horizontal-bar"` (alias `"hbar"` - use when category labels are long), `"line"`, `"area"`, `"donut"`, `"pie"` (alias of `donut`), `"scatter"` (alias `"bubble"`), `"stacked-bar"` (alias `"stacked"`), `"heatmap"`, `"funnel"`, `"gauge"`, `"sparkline"`. The full per-type config (axes, dual axis, `valueFormat`, the non-scaling percent rule, and the hand-rolled shapes such as treemap and sankey) lives in `chart-patterns.md`. Saved org templates register as types too.
139
+ **Standard `graphit.graph` types (set `config.type`):** `"bar"`, `"horizontal-bar"` (alias `"hbar"` - use when category labels are long), `"line"`, `"area"`, `"donut"`, `"pie"` (alias of `donut`), `"scatter"` (alias `"bubble"`), `"stacked-bar"` (alias `"stacked"`), `"heatmap"`, `"funnel"`, `"gauge"`, `"sparkline"`, plus the reserved `"custom"` (bespoke `draw`). The full per-type config (axes, dual axis, `valueFormat`, the non-scaling percent rule, the custom `ctx` contract, and hand-rolled shapes such as treemap and sankey) lives in `chart-patterns.md`. Saved org templates register as types too.
149
140
 
150
- **Logic versus styling.** `filter`, `param`, `bind`, `dateRange`, `cascade` are headless logic with zero imposed styling - you own the markup. `chart`, `table`, `kpi`, `presentation` render a fixed house style. Two trade-offs to surface to the user: a control persists to saved views ONLY when registered with `graphit.filter` / `param` / `dateRange` (a hand-rolled `<select>` will not save), and `graphit.chart` cannot be deeply restyled - hand-draw with SVG and CSS for a custom look while still fetching data via `graphit.resolve`.
141
+ **Logic versus styling.** `filter`, `param`, `bind`, `dateRange`, `cascade` are headless logic with zero imposed styling - you own the markup. A standard `graphit.graph` type, `table`, `kpi`, `presentation` render a fixed house style. Two trade-offs to surface to the user: a control persists to saved views ONLY when registered with `graphit.filter` / `param` / `dateRange` (a hand-rolled `<select>` will not save), and a standard chart type cannot be deeply restyled - for a custom look use `graphit.graph(el, {type:'custom', draw})` (responsive + themed, see `chart-patterns.md`) or hand-draw SVG/CSS, still fetching data via `graphit.resolve`.
151
142
 
152
143
  ## Canonical entity with live data
153
144
 
@@ -167,7 +158,7 @@ You have full creative freedom: build charts with inline SVG, CSS, and HTML tabl
167
158
  dataSourceId: "MARKETING_UA_DS",
168
159
  target: "#spend-chart"
169
160
  });
170
- graphit.chart("#spend-chart", {
161
+ graphit.graph("#spend-chart", {
171
162
  type: "bar", data: r.data, x: "MEDIA_SOURCE", y: "spend",
172
163
  title: "Ad Spend by Source", valueFormat: "currency"
173
164
  });