@unfenced-ai/sdk 0.1.0

package/LICENSE

@@ -0,0 +1,30 @@
+unfenced — Proprietary Software License
+Copyright © 2026 timeis-art. All rights reserved.
+
+This software, including its source code, design, documentation, and all
+associated materials (the "Software"), is the proprietary and confidential
+property of timeis-art. It is NOT open source.
+
+No license, right, or permission is granted to any person or entity to use,
+copy, reproduce, modify, adapt, merge, publish, distribute, transmit, display,
+sublicense, sell, or create derivative works of the Software, in whole or in
+part, except under a separate written agreement signed by timeis-art.
+
+Limited client grant. The published client packages "@unfenced-ai/mcp" and
+"@unfenced-ai/sdk" may be installed and used solely to connect to an authorized,
+paid unfenced service. This limited grant conveys no rights to the unfenced
+engine, server, or service; is personal and non-transferable; and may be
+modified or revoked at any time. It does not extend to any other part of the
+Software.
+
+Unauthorized access to, use, reproduction, or distribution of the Software is
+strictly prohibited and may violate applicable copyright and other laws.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. IN NO EVENT SHALL THE COPYRIGHT
+HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT, OR OTHERWISE, ARISING FROM, OUT OF, OR IN CONNECTION WITH THE
+SOFTWARE OR ITS USE.
+
+For licensing inquiries, contact timeis-art.

package/README.md

@@ -0,0 +1,171 @@
+# @unfenced-ai/sdk
+
+Typed client for [Unfenced](https://unfenced.ai) - fetch
+any page as clean, agent-ready content and drive a **real browser** (observe,
+click, type, extract) on the machine the server runs on, using the cookies that
+server holds for your account. Which address it egresses from is that
+deployment's configuration, not a property of this client.
+
+Zero dependencies. Uses the platform `fetch`, so it runs anywhere that has one - Node 22.12
+or newer, which is the floor for the `require` condition in its `exports` map.
+
+Not from a **browser page on another origin**, though: every request carries an
+`x-unfenced-client` header for attribution, which is not a CORS-safelisted header,
+so a cross-origin call preflights and the worker does not answer it. Node, a
+bundler, or same-origin code is the supported shape.
+
+## Install
+
+```bash
+npm install @unfenced-ai/sdk
+```
+
+> **Not on the registry yet.** `@unfenced-ai/sdk` answers 404 today; until the first
+> publish this package is only reachable from a checkout. Note the scope: the bare
+> `@unfenced` scope on npm belongs to somebody else and nothing there is ours - do not
+> install from it.
+
+You also need an unfenced service to point at - either the hosted endpoint from
+your dashboard's **Connect** panel, or a checkout running `pnpm dev`. The server is
+proprietary and not on npm; the **Connect** panel at <https://unfenced.ai> is where a
+hosted endpoint and a key come from. (This file ships inside the tarball, so a link into
+the repository would resolve nowhere for a reader who installed it.)
+
+## Fetch a page
+
+```ts
+import { Unfenced } from "@unfenced-ai/sdk";
+
+const ac = new Unfenced({
+  baseUrl: "http://127.0.0.1:8787", // where the server is
+  apiKey: process.env.UNFENCED_TOKEN, // required against a hosted service
+});
+
+const result = await ac.fetch("https://example.com");
+if (result.outcome === "delivered") {
+  console.log(result.meta.tier); // 1 = HTTP, 2 = stealth browser, 3 = headed
+  console.log(result.doc.markdown); // clean markdown, not raw HTML
+}
+```
+
+The fetch escalates from plain HTTP to a stealth browser to a headed browser
+only as far as the site forces - you always get back the same clean document.
+`result.meta.omissions` names content that was left out, including hidden text,
+listing prose, page limits, settling uncertainty, and byte or word caps.
+An unfinished browser navigation is reported as `navigation-incomplete`, not as a byte cap.
+`result.meta.totalWords` is present only when the full source was counted.
+`fetch()` and batch calls accept `robots: "ignore" | "report" | "obey"` alongside
+`identify` and `locale`; the SDK sends the same policy on every submitted job.
+
+There are **four** outcomes, not two: `delivered`, `failed`, `offered`, and
+`archived`. An `offered` result means the server found a door and did not open
+it (a paywall, a sign-in). An `archived` result is a history receipt whose full
+page content has expired; fetch the URL again to read it. There is
+deliberately no `result.ok`, because a boolean would compile everywhere and
+route every `offered` into whichever branch the caller already had for failure,
+silently. Branch on `outcome`.
+
+## Drive a live browser
+
+```ts
+const session = await ac.open("https://news.ycombinator.com");
+
+// See what's on the page. Controls the page DECLARES carry a stable `ref`;
+// things it merely draws as clickable arrive in `undeclared` with no ref, and
+// are reached by their visible words instead - act({ on: "3 people" }).
+const page = await session.observe();
+const search = page.controls.find((c) => /search/i.test(c.name));
+
+// Do things. A real mouse/keyboard drives it, through the same guardrails a
+// human has: password fields are refused, form-submits need `confirm: true`.
+if (search) {
+  await session.type(search.ref, "show hn", { submit: true, confirm: true });
+}
+
+// Read it clean, or watch it.
+const { content } = await session.extract("markdown");
+const jpeg = await session.screenshot(); // data: URI
+
+await session.close();
+```
+
+### Acting needs permission
+
+Reading a page is always allowed. **Acting** (click, type, select, keystroke)
+requires the site be on the act-allowlist - a deliberate boundary so a session
+holding real logins can only touch sites you named:
+
+```ts
+await ac.permissions(); // the sites this account may act on
+```
+
+`ac.allow()` and `ac.deny()` work only against a local checkout. On a hosted
+service both answer **403** - _an API key cannot grant site permissions_ - because
+deciding what an agent may click is a human control, and a key that could widen
+its own reach would not be one. Grant from the dashboard, or have the agent call
+`connect_site` to hand the owner a link.
+
+Note also that `permissions()` lists only the freely-allowed sites. A host held at
+_approve_ is not in it; `permissionEntries()` is the richer view that carries the
+mode.
+
+If you act on a site that isn't allowed, `act` returns
+`{ ok: false, permissionRequired: "<site>" }` rather than throwing - grant it
+and retry.
+
+## The session library
+
+Every demo / agent / live-channel run the server records is queryable:
+
+```ts
+const runs = await ac.sessions({ kind: "agent", q: "etsy", limit: 20 });
+const detail = await ac.recordedSession(runs[0].id); // frames, trace, answer
+```
+
+## API
+
+| Method                                                  | Does                                  |
+| ------------------------------------------------------- | ------------------------------------- |
+| `ac.fetch(url, opts?)`                                  | fetch one URL as clean content        |
+| `ac.batch(urls, opts?)`                                 | fetch many concurrently               |
+| `ac.open(url, opts?)`                                   | open a live browser → a `Session`     |
+| `ac.liveSessions()`                                     | list open live sessions               |
+| `ac.refresh(id, opts?)`                                 | current page plus provider continuity |
+| `ac.sessions(query?)` / `ac.recordedSession(id)`        | the recorded library                  |
+| `ac.history()` / `ac.domains()`                         | memory                                |
+| `ac.permissions()` / `ac.allow(site)` / `ac.deny(site)` | act-allowlist                         |
+| `session.refresh(opts?)`                                | current page plus provider continuity |
+| `session.observe(opts?)`                                | snapshot of controls/links/text       |
+| `session.click/type/select/press/scroll/navigate/back`  | act                                   |
+| `session.extract(format?)`                              | clean content of the open page        |
+| `session.screenshot()`                                  | JPEG data URI                         |
+| `session.close()`                                       | close it                              |
+
+Batch methods default to eight concurrent jobs. Set `concurrency` to an integer
+from 1 to 32 to tune that limit; invalid values reject before work starts. Results
+retain input order and reuse duplicate URLs. `batchWithin` stops submitting queued
+URLs when its shared deadline expires.
+
+`timeoutMs` and the shared `batchWithin` deadline accept integer milliseconds
+from 0 to 2147483647. Zero returns timeout results without submitting work.
+Invalid durations reject with `RangeError`, including for batch calls, before
+any URL is submitted.
+
+Errors surface as `UnfencedError` (carrying `status` and `detail`) for
+non-2xx responses; refusals from `act` come back as a result, not an exception.
+Structured errors also preserve `code`, `remedy`, a valid nonnegative integer
+`retryAfterMs` from the response body, and the original `retryAfter` header when
+present. The header can contain seconds or an HTTP date; it is not automatically
+converted or used to resubmit a request. Delays may exceed a runtime's timer
+range, so apply your task deadline and cancellation policy before waiting.
+A lost response can follow an accepted write: check the operation's state before
+retrying it. Retry guidance alone does not make a write safe to repeat.
+
+## License
+
+Proprietary. © 2026 timeis-art. All rights reserved. Not open source.
+
+This client may be installed and used **solely to connect to an authorized, paid
+unfenced service**. The grant is personal and non-transferable, conveys no rights
+to the unfenced engine, server or service, and may be modified or revoked at any
+time. See the `LICENSE` file in this package.

package/dist/client.d.ts

@@ -0,0 +1,385 @@
+import type { TokenUsage } from "./token-usage.js";
+import type { Session } from "./session.js";
+import type { ExtractedDoc } from "./protocol.js";
+import type { AccountPrefs, Action, ActResult, ActExpectation, AtAction, CredentialName, DownloadInfo, FetchOptions, FetchResult, Format, FormField, FormFillResult, MemoryEntry, MemoryRecallOptions, OnAction, PageSnapshot, PendingApproval, ProviderSessionReason, ReadPage, SeenPage, SessionDetail, SessionInfo, SessionSummary, UnfencedOptions } from "./types.js";
+export declare class Unfenced {
+    /** The transport. Holds the base URL, the token, the fetch, and the extra
+     *  headers — the four things every method's request needs — so the methods
+     *  themselves carry none of it. */
+    private readonly http;
+    constructor(options?: UnfencedOptions);
+    /** Report counts only. Never sends tool arguments, page text, or image data. */
+    recordTokenUsage(usage: TokenUsage): Promise<void>;
+    /**
+     * Fetch a URL as clean content. Escalates from plain HTTP to a stealth
+     * browser to a headed browser only as far as the site forces, and resolves
+     * when the job is done.
+     */
+    fetch(url: string, options?: FetchOptions): Promise<FetchResult>;
+    /**
+     * Fetch many URLs concurrently (each escalates independently).
+     *
+     * One entry per URL, in input order, with a failed URL carrying its structured
+     * error in place. A single bad URL must never cost the caller the whole batch —
+     * an agent batching 20 URLs would otherwise lose all 20 and have to bisect to
+     * find the offender.
+     */
+    batch(urls: string[], options?: FetchOptions): Promise<FetchResult[]>;
+    /**
+     * The same, but it always answers.
+     *
+     * `batch` resolves when every URL has, so one slow host decides when the
+     * whole call returns. An external QA run watched a ten-URL batch blow its
+     * client's sixty-second transport timeout — which returns NOTHING: every
+     * sibling that had already succeeded was discarded with it, and the caller
+     * got an opaque transport error naming no URL, so it could not even retry
+     * intelligently.
+     *
+     * The per-URL error isolation this tool promises only ever covered fast
+     * failures. This covers slow ones. Each URL races one shared deadline;
+     * whatever has not arrived becomes a `timeout` entry, in input order.
+     *
+     * A partial answer is worth far more to an agent than none — it can use what
+     * came back and retry exactly what did not.
+     */
+    batchWithin(urls: string[], deadlineMs: number, options?: FetchOptions): Promise<FetchResult[]>;
+    /**
+     * Open a live browser session on a URL and get a handle to drive it.
+     *
+     * `account` names a sign-in account to act as (e.g. a specific one of several
+     * Google logins). It selects that account's isolated, stored session — so the
+     * page opens already signed in as that account and cookie changes persist back
+     * to it. Absent means the default session.
+     *
+     * A SIGN-IN ACCOUNT's name ("google", "google-2") — not a site or host, and
+     * not the name of a per-site login ("namecheap.com"), which is a password used
+     * INSIDE an account rather than an account. A credential's `site` says where a
+     * login is used, not what it is called, and the two sit next to each other in
+     * every listing; passing either opened a Chrome profile and a stored session
+     * that nothing else ever read, so the login was asked for again and never
+     * reached the next machine. The server now answers `unknown-account` (400)
+     * rather than quietly creating that drawer — unless the name already HAS a
+     * stored session, which is a drawer it opens rather than mints. A roster it
+     * could not read answers `accounts-unreadable` (503): retry, or omit `account`.
+     */
+    open(url: string, options?: {
+        headless?: boolean;
+        profile?: "ephemeral" | "agent";
+        proxy?: string;
+        account?: string;
+        /**
+         * What you mean to do with the page. `"act"` states that it will be
+         * clicked, typed into or submitted.
+         *
+         * It matters because a live browser costs a measured ~819 MB and one of the
+         * account's session slots, held until it idles out. A page that domain
+         * memory already knows a plain fetch answers, with no stored login for it,
+         * is refused with `use-fetch` rather than spending that on bytes
+         * `fetch()` returns. Passing `"act"` opens it.
+         */
+        intent?: "read" | "act";
+        /**
+         * How long to let the network go quiet after the page commits, before the
+         * opening snapshot is taken. Default 4000ms, maximum 15000.
+         *
+         * A different clock from the navigation's own timeout: a page that
+         * exceeds THIS one is read as it stands rather than refused, so raising
+         * it buys a more complete first reading of a page that draws from several
+         * slow fetches, and never turns a slow page into an error.
+         */
+        settleMs?: number;
+    }): Promise<Session & {
+        providerSession?: ProviderSessionReason;
+        /** True when this is a page you already had open on the host, not a new one. */
+        reusedExistingSession?: boolean;
+        /** True when that reused page was navigated to the URL you asked for. */
+        navigated?: boolean;
+        /**
+         * Something about THIS open worth saying, when there is anything.
+         *
+         * Two producers, one field: a reused page that was navigated, and an open
+         * whose settle budget ran out with the network still busy — meaning the
+         * snapshot beside it may not be the finished page. Both answer "what would
+         * you otherwise have to guess about this reading", which is why they share
+         * a name rather than each having one.
+         */
+        note?: string;
+    }>;
+    /**
+     * Switch an open session to a DIFFERENT sign-in account — "check my other
+     * account". An account is bound to a page's isolated profile at open, so this
+     * is not a live swap: the current account's jar is saved, its page closed, and
+     * the same SITE reopened signed in as `account`. Returns a NEW Session (a new
+     * id) — use it going forward; the old one is closed. A one-off that never
+     * changes the site's configured default.
+     *
+     * `account` is a sign-in account's NAME, never a site or host — an unknown one
+     * is refused with `unknown-account` (400) BEFORE the open page is torn down, so
+     * a bad name costs nothing and leaves the current session usable.
+     */
+    switchAccount(sessionId: string, account: string): Promise<{
+        session: Session;
+        restoredSession: boolean;
+        requestedAccount?: string;
+        observedIdentity?: string;
+    }>;
+    /**
+     * Which account the page is actually signed in as — the DOWNSTREAM identity (e.g.
+     * which ChatGPT account), not the provider login that reached it. A non-disruptive
+     * same-origin read, so it can confirm identity mid-task. `identity` is null when the
+     * site is not one the server knows how to read (then observe the account menu).
+     */
+    /**
+     * What the account owner has to clear before the agent can continue.
+     *
+     * Read-only, and it must stay that way: a wall is cleared by a
+     * human-authenticated action, never by the caller that is blocked on it. An
+     * agent asking this is asking "what do you need from me" on the user's behalf,
+     * which is worth having as a question because most people do not live in the
+     * dashboard and would otherwise never learn a sign-in was waiting.
+     *
+     * `clearAt` is where the person goes. Hand that over rather than describing a
+     * screen.
+     */
+    pendingApprovals(): Promise<{
+        interrupts: PendingApproval[];
+        clearAt: string;
+    }>;
+    whoami(sessionId: string): Promise<{
+        identity: string | null;
+        source: string | null;
+    }>;
+    /** Every live session currently open on the server. */
+    liveSessions(): Promise<SessionInfo[]>;
+    observe(id: string, opts?: {
+        match?: string;
+        maxControls?: number;
+        maxLinks?: number;
+        excerptChars?: number;
+        media?: boolean;
+    }): Promise<PageSnapshot>;
+    /** Read the current page together with its provider-session continuity state. */
+    refresh(id: string, opts?: {
+        match?: string;
+    }): Promise<{
+        page: PageSnapshot;
+        providerSession?: ProviderSessionReason;
+    }>;
+    /**
+     * Read a page, and receive a picture with it when the reading cannot describe
+     * the page on its own.
+     *
+     * `observe` above returns the snapshot alone and keeps doing so, because that
+     * is what its callers expect. This one hands back the whole envelope — the
+     * server attaches `picture` and `marks` when the reading reports `look`, and a
+     * projection that quietly dropped them would put the agent back where it
+     * started: told that something is missing and made to spend a turn asking for
+     * it.
+     */
+    read(id: string, opts?: {
+        match?: string;
+        maxControls?: number;
+        maxLinks?: number;
+        excerptChars?: number;
+        media?: boolean;
+    }): Promise<ReadPage>;
+    /**
+     * `opts` are OPTIONS on the call, not fields of the action — a native dialog is
+     * raised by the page mid-act and is not part of what was asked of it.
+     */
+    act(id: string, action: Action | OnAction | AtAction, opts?: {
+        acceptDialog?: boolean;
+        dialogText?: string;
+        brief?: boolean;
+        /**
+         * Return a marked picture of the page this act landed on, in the same
+         * reply, as `view`. `brief`'s opposite, and the same kind of option: it
+         * changes the shape of the ANSWER, not what the page is asked to do.
+         */
+        see?: boolean;
+        /**
+         * What the act is supposed to ACHIEVE, checked after it runs. The reply
+         * carries `expected: {held, waitedMs}`. This type declared that reply
+         * field long before anything could ask for it.
+         */
+        expect?: ActExpectation;
+    }): Promise<ActResult>;
+    extract(id: string, format?: Format, maxWords?: number): Promise<{
+        doc: ExtractedDoc;
+        content: string;
+        url: string;
+        contentTruncated?: boolean;
+        totalWords?: number;
+    }>;
+    screenshot(id: string): Promise<string>;
+    /**
+     * A picture of the page with everything actable outlined and numbered.
+     *
+     * Separate from `screenshot` rather than an option on it, because the two have
+     * different callers and different costs: `screenshot` feeds a replay stream
+     * many times a turn and must stay a bare frame, while this one pays for a
+     * snapshot in order to guarantee the boxes and the list describe one instant.
+     */
+    see(id: string, opts?: {
+        /** Box the links too, numbered after the controls. Off by default: a page
+         *  with two hundred of them is papered over. */
+        links?: boolean;
+        /** Raise the 50-box cap, up to 120. Anything else falls back to 50. */
+        maxMarks?: number;
+    }): Promise<SeenPage>;
+    /**
+     * Fill several fields in one call.
+     *
+     * The saving is model round trips, not network ones. Text only and never
+     * submits — a password goes through `act` as a fill_secret, which is the one
+     * path allowed to resolve a stored value.
+     */
+    fill(id: string, fields: readonly FormField[]): Promise<FormFillResult>;
+    /**
+     * Hold a page open while something happens elsewhere.
+     *
+     * For the wait a login actually involves: a code sent to email, an approval
+     * in an app. Capped by the server, and a parked page still holds a real tab,
+     * so only a few may be parked at once.
+     */
+    park(id: string, minutes?: number, reason?: string): Promise<{
+        ok: boolean;
+        until?: string;
+    }>;
+    /** Files this session's page has handed to the browser. Names and sizes. */
+    downloads(id: string): Promise<{
+        downloads: DownloadInfo[];
+    }>;
+    /**
+     * Read one of them as text.
+     *
+     * A PDF goes through the same reader a fetched PDF does, so downloading a
+     * statement and reading it is one capability rather than two halves of one.
+     */
+    readDownload(id: string, filename: string): Promise<{
+        filename: string;
+        bytes: number;
+        content: string;
+        doc: ExtractedDoc;
+    }>;
+    /**
+     * Release a live page. Idempotent: closing one that has already closed — or
+     * idled out — succeeds and says so, because that is the state you asked for.
+     */
+    /**
+     * Release a page. Idempotent: closing one that is already gone is the state
+     * the caller asked for, so it succeeds rather than erroring — an agent
+     * closing in a `finally` must not be punished for a slow task.
+     *
+     * `wasOpen` says whether anything was actually released. It is false for an
+     * id that is not open FOR YOU, which covers a mistyped id, one that idled
+     * out, and one that was closed earlier — deliberately not told apart, since
+     * three different answers would let an 8-character id be probed for
+     * existence across accounts.
+     */
+    closeSession(id: string): Promise<{
+        alreadyClosed?: boolean;
+        wasOpen?: boolean;
+    }>;
+    /** Recorded runs (demo / agent / live-channel), newest first. */
+    sessions(query?: {
+        kind?: string;
+        q?: string;
+        limit?: number;
+    }): Promise<SessionSummary[]>;
+    /** A recorded session with its replay frames, tool trace, and answer. */
+    recordedSession(id: string): Promise<SessionDetail>;
+    history(limit?: number): Promise<unknown[]>;
+    domains(): Promise<unknown[]>;
+    /** Sites the agent may act on WITHOUT asking (the free bucket only). */
+    permissions(): Promise<string[]>;
+    /**
+     * Every saved site with its mode. This — not permissions() — is what "may I act
+     * here?" must read: BOTH `free` and `approve` permit acting (approve just asks
+     * the human per action); only `read` does not. permissions() returns free-only,
+     * so a site granted "Ask each time" is invisible to it — which made agents give
+     * up on approve-granted sites they were in fact allowed to act on.
+     */
+    /**
+     * The act-allowlist AND whether this key is exempt from it.
+     *
+     * `permissionEntries` returns the granted hosts and nothing else, which reads
+     * as "these and no others" — wrong for a key carrying any-site, whose list is
+     * usually empty precisely because it needs no grants. Callers that decide
+     * whether to ATTEMPT something must use this one; the older method stays for
+     * callers that only want to display the grants.
+     */
+    permissionScope(): Promise<{
+        entries: Array<{
+            host: string;
+            mode: "free" | "approve" | "read";
+        }>;
+        anySite: boolean;
+        excludedSites: string[];
+        allowSiteRequests?: boolean;
+    }>;
+    permissionEntries(): Promise<Array<{
+        host: string;
+        mode: "free" | "approve" | "read";
+    }>>;
+    /**
+     * A deep link that opens the dashboard set up to unblock a site — the Add-login
+     * drawer for a missing login (mode "credential", the default), or the Sites
+     * grant for a missing permission (mode "permission"). Hand this to a person so
+     * they fix it in one screen; it carries only the host, never a secret.
+     */
+    connectLink(host: string, opts?: {
+        label?: string;
+        mode?: "credential" | "permission";
+    }): Promise<string>;
+    /** Allow the agent to act on a site. Returns the host key that was stored. */
+    allow(site: string): Promise<string>;
+    /** Revoke acting on a site. */
+    deny(site: string): Promise<boolean>;
+    /**
+     * Jot a durable note keyed by a short label, scoped to this agent.
+     *
+     * Survives across sessions — the agent's own scratchpad for task state, not a
+     * secret store. Setting the same key again overwrites it. Rejected server-side
+     * for an empty/oversized key or value, or when the scratchpad is full.
+     */
+    remember(key: string, value: string): Promise<MemoryEntry>;
+    /** Every note this agent holds, newest first. */
+    recall(): Promise<MemoryEntry[]>;
+    /** A bounded/prefix-filtered list of notes, newest first. */
+    recall(options: MemoryRecallOptions): Promise<MemoryEntry[]>;
+    /** One note by key, or `undefined` when nothing is stored under it. */
+    recall(key: string): Promise<MemoryEntry | undefined>;
+    /** Forget a note. Returns whether one was actually removed. */
+    forget(key: string): Promise<boolean>;
+    /**
+     * Store (or rotate) a secret under a name, scoped to this account+agent.
+     *
+     * This is the HUMAN path: a person at a dashboard/CLI puts the secret in once,
+     * and the agent thereafter fills it by name with a `fill_secret` action,
+     * never seeing the value. Returns the name, the account identifier, and the
+     * time — never the secret. There is deliberately no method that reads a stored
+     * secret back.
+     *
+     * `username` is the optional account email/login this credential is for, shown
+     * back so a login is recognizable. OMIT it on a password rotation to preserve
+     * the existing identifier; pass an empty string to clear it.
+     *
+     * `kind` is "password" (default) or "totp" — for a TOTP, `secret` is the
+     * authenticator SEED (a base32 string or otpauth:// URI), and the agent fills
+     * the current code with a fill_totp action, never seeing the seed or the code.
+     */
+    storeCredential(name: string, secret: string, username?: string, kind?: "password" | "totp"): Promise<CredentialName>;
+    /** The NAMES of the credentials stored for this account+agent. Never values. */
+    credentialNames(): Promise<CredentialName[]>;
+    /** Delete a stored credential by name. Returns whether one was removed. */
+    deleteCredential(name: string): Promise<boolean>;
+    /**
+     * How this account wants the agent to choose among several sign-in accounts:
+     * `askMode` "always" (ask every time a provider is ambiguous) or "remember"
+     * (reuse a per-site choice), plus the remembered site→account map. open_page
+     * reads this to decide whether to ask or reuse.
+     */
+    accountPrefs(): Promise<AccountPrefs>;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAO5C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EACV,YAAY,EACZ,MAAM,EACN,SAAS,EACT,cAAc,EACd,QAAQ,EACR,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,MAAM,EACN,SAAS,EACT,cAAc,EACd,WAAW,EACX,mBAAmB,EACnB,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,qBAAqB,EACrB,QAAQ,EACR,QAAQ,EACR,aAAa,EACb,WAAW,EACX,cAAc,EACd,eAAe,EAChB,MAAM,YAAY,CAAC;AAEpB,qBAAa,QAAQ;IACnB;;uCAEmC;IACnC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAY;gBAErB,OAAO,GAAE,eAAoB;IAIzC,gFAAgF;IAC1E,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAMxD;;;;OAIG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,WAAW,CAAC;IAIpE;;;;;;;OAOG;IACH,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAIzE;;;;;;;;;;;;;;;;OAgBG;IACH,WAAW,CACT,IAAI,EAAE,MAAM,EAAE,EACd,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,WAAW,EAAE,CAAC;IAMzB;;;;;;;;;;;;;;;;;;OAkBG;IACH,IAAI,CACF,GAAG,EAAE,MAAM,EACX,OAAO,GAAE;QACP,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAChC,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB;;;;;;;;;WASG;QACH,MAAM,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;QACxB;;;;;;;;WAQG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAC;KACd,GACL,OAAO,CACR,OAAO,GAAG;QACR,eAAe,CAAC,EAAE,qBAAqB,CAAC;QACxC,gFAAgF;QAChF,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,yEAAyE;QACzE,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB;;;;;;;;WAQG;QACH,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CACF;IAID;;;;;;;;;;;OAWG;IACH,aAAa,CACX,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,eAAe,EAAE,OAAO,CAAC;QACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IAIF;;;;;OAKG;IACH;;;;;;;;;;;OAWG;IACH,gBAAgB,IAAI,OAAO,CAAC;QAAE,UAAU,EAAE,eAAe,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAI/E,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAItF,uDAAuD;IACvD,YAAY,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAKtC,OAAO,CACL,EAAE,EAAE,MAAM,EACV,IAAI,CAAC,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GACA,OAAO,CAAC,YAAY,CAAC;IAIxB,iFAAiF;IACjF,OAAO,CACL,EAAE,EAAE,MAAM,EACV,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GACxB,OAAO,CAAC;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,eAAe,CAAC,EAAE,qBAAqB,CAAA;KAAE,CAAC;IAI3E;;;;;;;;;;OAUG;IACH,IAAI,CACF,EAAE,EAAE,MAAM,EACV,IAAI,CAAC,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GACA,OAAO,CAAC,QAAQ,CAAC;IAGpB;;;OAGG;IACH,GAAG,CACD,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,QAAQ,EACpC,IAAI,CAAC,EAAE;QACL,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB;;;;WAIG;QACH,GAAG,CAAC,EAAE,OAAO,CAAC;QACd;;;;WAIG;QACH,MAAM,CAAC,EAAE,cAAc,CAAC;KACzB,GACA,OAAO,CAAC,SAAS,CAAC;IAGrB,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,GAAE,MAAmB,EAAE,QAAQ,CAAC,EAAE,MAAM;;;;;;;IAGlE,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIvC;;;;;;;OAOG;IACH,GAAG,CACD,EAAE,EAAE,MAAM,EACV,IAAI,GAAE;QACJ;wDACgD;QAChD,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,uEAAuE;QACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;KACd,GACL,OAAO,CAAC,QAAQ,CAAC;IAIpB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,SAAS,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC;IAGvE;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAG7F,4EAA4E;IAC5E,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,YAAY,EAAE,CAAA;KAAE,CAAC;IAG7D;;;;;OAKG;IACH,YAAY,CACV,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,YAAY,CAAA;KAAE,CAAC;IAGnF;;;OAGG;IACH;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,aAAa,CAAC,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAMjF,iEAAiE;IACjE,QAAQ,CAAC,KAAK,GAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAG9F,yEAAyE;IACzE,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAGnD,OAAO,CAAC,KAAK,SAAK,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAGvC,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAM7B,wEAAwE;IACxE,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAGhC;;;;;;OAMG;IACH;;;;;;;;OAQG;IACH,eAAe,IAAI,OAAO,CAAC;QACzB,OAAO,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAA;SAAE,CAAC,CAAC;QACpE,OAAO,EAAE,OAAO,CAAC;QACjB,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,iBAAiB,CAAC,EAAE,OAAO,CAAC;KAC7B,CAAC;IAGF,iBAAiB,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAA;KAAE,CAAC,CAAC;IAGxF;;;;;OAKG;IACH,WAAW,CACT,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,YAAY,GAAG,YAAY,CAAA;KAAO,GAChE,OAAO,CAAC,MAAM,CAAC;IAGlB,8EAA8E;IAC9E,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAGpC,+BAA+B;IAC/B,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMpC;;;;;;OAMG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAG1D,iDAAiD;IACjD,MAAM,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAChC,6DAA6D;IAC7D,MAAM,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAC5D,uEAAuE;IACvE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAMrD,+DAA+D;IAC/D,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMrC;;;;;;;;;;;;;;;;OAgBG;IACH,eAAe,CACb,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,EACjB,IAAI,CAAC,EAAE,UAAU,GAAG,MAAM,GACzB,OAAO,CAAC,cAAc,CAAC;IAI1B,gFAAgF;IAChF,eAAe,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAI5C,2EAA2E;IAC3E,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIhD;;;;;OAKG;IACH,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;CAGtC"}