@unfenced-ai/sdk 0.1.0

package/dist/client.js

@@ -0,0 +1,349 @@
+/**
+ * The `Unfenced` client class — the package's public entry point.
+ *
+ * Every method's signature and doc comment is exactly what it was in the former
+ * single-file `index.ts`; only the bodies changed, from inline logic to a one
+ * line call into the domain module that now holds it (`fetching`, `live`,
+ * `library`, `perms`, `memory`, `vault`). The four transport fields and the
+ * private `request`/`awaitJob` helpers moved into `Transport` and `fetch.ts`, so
+ * the one private field left is `http`. The public surface is unchanged.
+ */
+import { Transport } from "./http.js";
+import * as fetching from "./fetch.js";
+import * as live from "./sessions.js";
+import * as library from "./library.js";
+import * as perms from "./permissions.js";
+import * as memory from "./memory.js";
+import * as vault from "./credentials.js";
+export class Unfenced {
+    /** The transport. Holds the base URL, the token, the fetch, and the extra
+     *  headers — the four things every method's request needs — so the methods
+     *  themselves carry none of it. */
+    http;
+    constructor(options = {}) {
+        this.http = new Transport(options);
+    }
+    /** Report counts only. Never sends tool arguments, page text, or image data. */
+    async recordTokenUsage(usage) {
+        await this.http.request("POST", "/usage/tokens", usage, 1500);
+    }
+    // ---- fetch -------------------------------------------------------------
+    /**
+     * Fetch a URL as clean content. Escalates from plain HTTP to a stealth
+     * browser to a headed browser only as far as the site forces, and resolves
+     * when the job is done.
+     */
+    fetch(url, options = {}) {
+        return fetching.fetch(this.http, url, options);
+    }
+    /**
+     * Fetch many URLs concurrently (each escalates independently).
+     *
+     * One entry per URL, in input order, with a failed URL carrying its structured
+     * error in place. A single bad URL must never cost the caller the whole batch —
+     * an agent batching 20 URLs would otherwise lose all 20 and have to bisect to
+     * find the offender.
+     */
+    batch(urls, options = {}) {
+        return fetching.batch(this.http, urls, options);
+    }
+    /**
+     * The same, but it always answers.
+     *
+     * `batch` resolves when every URL has, so one slow host decides when the
+     * whole call returns. An external QA run watched a ten-URL batch blow its
+     * client's sixty-second transport timeout — which returns NOTHING: every
+     * sibling that had already succeeded was discarded with it, and the caller
+     * got an opaque transport error naming no URL, so it could not even retry
+     * intelligently.
+     *
+     * The per-URL error isolation this tool promises only ever covered fast
+     * failures. This covers slow ones. Each URL races one shared deadline;
+     * whatever has not arrived becomes a `timeout` entry, in input order.
+     *
+     * A partial answer is worth far more to an agent than none — it can use what
+     * came back and retry exactly what did not.
+     */
+    batchWithin(urls, deadlineMs, options = {}) {
+        return fetching.batchWithin(this.http, urls, deadlineMs, options);
+    }
+    // ---- live sessions -----------------------------------------------------
+    /**
+     * Open a live browser session on a URL and get a handle to drive it.
+     *
+     * `account` names a sign-in account to act as (e.g. a specific one of several
+     * Google logins). It selects that account's isolated, stored session — so the
+     * page opens already signed in as that account and cookie changes persist back
+     * to it. Absent means the default session.
+     *
+     * A SIGN-IN ACCOUNT's name ("google", "google-2") — not a site or host, and
+     * not the name of a per-site login ("namecheap.com"), which is a password used
+     * INSIDE an account rather than an account. A credential's `site` says where a
+     * login is used, not what it is called, and the two sit next to each other in
+     * every listing; passing either opened a Chrome profile and a stored session
+     * that nothing else ever read, so the login was asked for again and never
+     * reached the next machine. The server now answers `unknown-account` (400)
+     * rather than quietly creating that drawer — unless the name already HAS a
+     * stored session, which is a drawer it opens rather than mints. A roster it
+     * could not read answers `accounts-unreadable` (503): retry, or omit `account`.
+     */
+    open(url, options = {}) {
+        return live.open(this, this.http, url, options);
+    }
+    /**
+     * Switch an open session to a DIFFERENT sign-in account — "check my other
+     * account". An account is bound to a page's isolated profile at open, so this
+     * is not a live swap: the current account's jar is saved, its page closed, and
+     * the same SITE reopened signed in as `account`. Returns a NEW Session (a new
+     * id) — use it going forward; the old one is closed. A one-off that never
+     * changes the site's configured default.
+     *
+     * `account` is a sign-in account's NAME, never a site or host — an unknown one
+     * is refused with `unknown-account` (400) BEFORE the open page is torn down, so
+     * a bad name costs nothing and leaves the current session usable.
+     */
+    switchAccount(sessionId, account) {
+        return live.switchAccount(this, this.http, sessionId, account);
+    }
+    /**
+     * Which account the page is actually signed in as — the DOWNSTREAM identity (e.g.
+     * which ChatGPT account), not the provider login that reached it. A non-disruptive
+     * same-origin read, so it can confirm identity mid-task. `identity` is null when the
+     * site is not one the server knows how to read (then observe the account menu).
+     */
+    /**
+     * What the account owner has to clear before the agent can continue.
+     *
+     * Read-only, and it must stay that way: a wall is cleared by a
+     * human-authenticated action, never by the caller that is blocked on it. An
+     * agent asking this is asking "what do you need from me" on the user's behalf,
+     * which is worth having as a question because most people do not live in the
+     * dashboard and would otherwise never learn a sign-in was waiting.
+     *
+     * `clearAt` is where the person goes. Hand that over rather than describing a
+     * screen.
+     */
+    pendingApprovals() {
+        return live.pendingApprovals(this.http);
+    }
+    whoami(sessionId) {
+        return live.whoami(this.http, sessionId);
+    }
+    /** Every live session currently open on the server. */
+    liveSessions() {
+        return live.liveSessions(this.http);
+    }
+    // Internal — used by Session.
+    observe(id, opts) {
+        return live.observe(this.http, id, opts);
+    }
+    /** Read the current page together with its provider-session continuity state. */
+    refresh(id, opts) {
+        return live.refresh(this.http, id, opts);
+    }
+    /**
+     * Read a page, and receive a picture with it when the reading cannot describe
+     * the page on its own.
+     *
+     * `observe` above returns the snapshot alone and keeps doing so, because that
+     * is what its callers expect. This one hands back the whole envelope — the
+     * server attaches `picture` and `marks` when the reading reports `look`, and a
+     * projection that quietly dropped them would put the agent back where it
+     * started: told that something is missing and made to spend a turn asking for
+     * it.
+     */
+    read(id, opts) {
+        return live.read(this.http, id, opts);
+    }
+    /**
+     * `opts` are OPTIONS on the call, not fields of the action — a native dialog is
+     * raised by the page mid-act and is not part of what was asked of it.
+     */
+    act(id, action, opts) {
+        return live.act(this.http, id, action, opts);
+    }
+    extract(id, format = "markdown", maxWords) {
+        return live.extract(this.http, id, format, maxWords);
+    }
+    screenshot(id) {
+        return live.screenshot(this.http, id);
+    }
+    /**
+     * A picture of the page with everything actable outlined and numbered.
+     *
+     * Separate from `screenshot` rather than an option on it, because the two have
+     * different callers and different costs: `screenshot` feeds a replay stream
+     * many times a turn and must stay a bare frame, while this one pays for a
+     * snapshot in order to guarantee the boxes and the list describe one instant.
+     */
+    see(id, opts = {}) {
+        return live.see(this.http, id, opts);
+    }
+    /**
+     * Fill several fields in one call.
+     *
+     * The saving is model round trips, not network ones. Text only and never
+     * submits — a password goes through `act` as a fill_secret, which is the one
+     * path allowed to resolve a stored value.
+     */
+    fill(id, fields) {
+        return live.fill(this.http, id, fields);
+    }
+    /**
+     * Hold a page open while something happens elsewhere.
+     *
+     * For the wait a login actually involves: a code sent to email, an approval
+     * in an app. Capped by the server, and a parked page still holds a real tab,
+     * so only a few may be parked at once.
+     */
+    park(id, minutes, reason) {
+        return live.park(this.http, id, minutes, reason);
+    }
+    /** Files this session's page has handed to the browser. Names and sizes. */
+    downloads(id) {
+        return live.downloads(this.http, id);
+    }
+    /**
+     * Read one of them as text.
+     *
+     * A PDF goes through the same reader a fetched PDF does, so downloading a
+     * statement and reading it is one capability rather than two halves of one.
+     */
+    readDownload(id, filename) {
+        return live.readDownload(this.http, id, filename);
+    }
+    /**
+     * Release a live page. Idempotent: closing one that has already closed — or
+     * idled out — succeeds and says so, because that is the state you asked for.
+     */
+    /**
+     * Release a page. Idempotent: closing one that is already gone is the state
+     * the caller asked for, so it succeeds rather than erroring — an agent
+     * closing in a `finally` must not be punished for a slow task.
+     *
+     * `wasOpen` says whether anything was actually released. It is false for an
+     * id that is not open FOR YOU, which covers a mistyped id, one that idled
+     * out, and one that was closed earlier — deliberately not told apart, since
+     * three different answers would let an 8-character id be probed for
+     * existence across accounts.
+     */
+    closeSession(id) {
+        return live.closeSession(this.http, id);
+    }
+    // ---- library & memory --------------------------------------------------
+    /** Recorded runs (demo / agent / live-channel), newest first. */
+    sessions(query = {}) {
+        return library.sessions(this.http, query);
+    }
+    /** A recorded session with its replay frames, tool trace, and answer. */
+    recordedSession(id) {
+        return library.recordedSession(this.http, id);
+    }
+    history(limit = 50) {
+        return library.history(this.http, limit);
+    }
+    domains() {
+        return library.domains(this.http);
+    }
+    // ---- act-allowlist -----------------------------------------------------
+    /** Sites the agent may act on WITHOUT asking (the free bucket only). */
+    permissions() {
+        return perms.permissions(this.http);
+    }
+    /**
+     * Every saved site with its mode. This — not permissions() — is what "may I act
+     * here?" must read: BOTH `free` and `approve` permit acting (approve just asks
+     * the human per action); only `read` does not. permissions() returns free-only,
+     * so a site granted "Ask each time" is invisible to it — which made agents give
+     * up on approve-granted sites they were in fact allowed to act on.
+     */
+    /**
+     * The act-allowlist AND whether this key is exempt from it.
+     *
+     * `permissionEntries` returns the granted hosts and nothing else, which reads
+     * as "these and no others" — wrong for a key carrying any-site, whose list is
+     * usually empty precisely because it needs no grants. Callers that decide
+     * whether to ATTEMPT something must use this one; the older method stays for
+     * callers that only want to display the grants.
+     */
+    permissionScope() {
+        return perms.permissionScope(this.http);
+    }
+    permissionEntries() {
+        return perms.permissionEntries(this.http);
+    }
+    /**
+     * A deep link that opens the dashboard set up to unblock a site — the Add-login
+     * drawer for a missing login (mode "credential", the default), or the Sites
+     * grant for a missing permission (mode "permission"). Hand this to a person so
+     * they fix it in one screen; it carries only the host, never a secret.
+     */
+    connectLink(host, opts = {}) {
+        return perms.connectLink(this.http, host, opts);
+    }
+    /** Allow the agent to act on a site. Returns the host key that was stored. */
+    allow(site) {
+        return perms.allow(this.http, site);
+    }
+    /** Revoke acting on a site. */
+    deny(site) {
+        return perms.deny(this.http, site);
+    }
+    // ---- task memory -------------------------------------------------------
+    /**
+     * Jot a durable note keyed by a short label, scoped to this agent.
+     *
+     * Survives across sessions — the agent's own scratchpad for task state, not a
+     * secret store. Setting the same key again overwrites it. Rejected server-side
+     * for an empty/oversized key or value, or when the scratchpad is full.
+     */
+    remember(key, value) {
+        return memory.remember(this.http, key, value);
+    }
+    recall(keyOrOptions) {
+        return memory.recall(this.http, keyOrOptions);
+    }
+    /** Forget a note. Returns whether one was actually removed. */
+    forget(key) {
+        return memory.forget(this.http, key);
+    }
+    // ---- credential vault --------------------------------------------------
+    /**
+     * Store (or rotate) a secret under a name, scoped to this account+agent.
+     *
+     * This is the HUMAN path: a person at a dashboard/CLI puts the secret in once,
+     * and the agent thereafter fills it by name with a `fill_secret` action,
+     * never seeing the value. Returns the name, the account identifier, and the
+     * time — never the secret. There is deliberately no method that reads a stored
+     * secret back.
+     *
+     * `username` is the optional account email/login this credential is for, shown
+     * back so a login is recognizable. OMIT it on a password rotation to preserve
+     * the existing identifier; pass an empty string to clear it.
+     *
+     * `kind` is "password" (default) or "totp" — for a TOTP, `secret` is the
+     * authenticator SEED (a base32 string or otpauth:// URI), and the agent fills
+     * the current code with a fill_totp action, never seeing the seed or the code.
+     */
+    storeCredential(name, secret, username, kind) {
+        return vault.storeCredential(this.http, name, secret, username, kind);
+    }
+    /** The NAMES of the credentials stored for this account+agent. Never values. */
+    credentialNames() {
+        return vault.credentialNames(this.http);
+    }
+    /** Delete a stored credential by name. Returns whether one was removed. */
+    deleteCredential(name) {
+        return vault.deleteCredential(this.http, name);
+    }
+    /**
+     * How this account wants the agent to choose among several sign-in accounts:
+     * `askMode` "always" (ask every time a provider is ambiguous) or "remember"
+     * (reuse a per-site choice), plus the remembered site→account map. open_page
+     * reads this to decide whether to ask or reuse.
+     */
+    accountPrefs() {
+        return vault.accountPrefs(this.http);
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC,OAAO,KAAK,QAAQ,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,eAAe,CAAC;AACtC,OAAO,KAAK,OAAO,MAAM,cAAc,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,kBAAkB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,KAAK,MAAM,kBAAkB,CAAC;AA6B1C,MAAM,OAAO,QAAQ;IACnB;;uCAEmC;IAClB,IAAI,CAAY;IAEjC,YAAY,UAA2B,EAAE;QACvC,IAAI,CAAC,IAAI,GAAG,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,gBAAgB,CAAC,KAAiB;QACtC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAChE,CAAC;IAED,2EAA2E;IAE3E;;;;OAIG;IACH,KAAK,CAAC,GAAW,EAAE,UAAwB,EAAE;QAC3C,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,IAAc,EAAE,UAAwB,EAAE;QAC9C,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,WAAW,CACT,IAAc,EACd,UAAkB,EAClB,UAAwB,EAAE;QAE1B,OAAO,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAED,2EAA2E;IAE3E;;;;;;;;;;;;;;;;;;OAkBG;IACH,IAAI,CACF,GAAW,EACX,UA0BI,EAAE;QAoBN,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;;;;;;OAWG;IACH,aAAa,CACX,SAAiB,EACjB,OAAe;QAOf,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC;IAED;;;;;OAKG;IACH;;;;;;;;;;;OAWG;IACH,gBAAgB;QACd,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,CAAC,SAAiB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC3C,CAAC;IAED,uDAAuD;IACvD,YAAY;QACV,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,8BAA8B;IAC9B,OAAO,CACL,EAAU,EACV,IAMC;QAED,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,iFAAiF;IACjF,OAAO,CACL,EAAU,EACV,IAAyB;QAEzB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;;;;;OAUG;IACH,IAAI,CACF,EAAU,EACV,IAMC;QAED,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IACD;;;OAGG;IACH,GAAG,CACD,EAAU,EACV,MAAoC,EACpC,IAgBC;QAED,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,CAAC,EAAU,EAAE,SAAiB,UAAU,EAAE,QAAiB;QAChE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACvD,CAAC;IACD,UAAU,CAAC,EAAU;QACnB,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACxC,CAAC;IAED;;;;;;;OAOG;IACH,GAAG,CACD,EAAU,EACV,OAMI,EAAE;QAEN,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IAED;;;;;;OAMG;IACH,IAAI,CAAC,EAAU,EAAE,MAA4B;QAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IACD;;;;;;OAMG;IACH,IAAI,CAAC,EAAU,EAAE,OAAgB,EAAE,MAAe;QAChD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IACD,4EAA4E;IAC5E,SAAS,CAAC,EAAU;QAClB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACvC,CAAC;IACD;;;;;OAKG;IACH,YAAY,CACV,EAAU,EACV,QAAgB;QAEhB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IACpD,CAAC;IACD;;;OAGG;IACH;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAU;QACrB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,2EAA2E;IAE3E,iEAAiE;IACjE,QAAQ,CAAC,QAAuD,EAAE;QAChE,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC;IACD,yEAAyE;IACzE,eAAe,CAAC,EAAU;QACxB,OAAO,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,CAAC,KAAK,GAAG,EAAE;QAChB,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO;QACL,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,2EAA2E;IAE3E,wEAAwE;IACxE,WAAW;QACT,OAAO,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD;;;;;;OAMG;IACH;;;;;;;;OAQG;IACH,eAAe;QAMb,OAAO,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IACD,iBAAiB;QACf,OAAO,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD;;;;;OAKG;IACH,WAAW,CACT,IAAY,EACZ,OAA+D,EAAE;QAEjE,OAAO,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAClD,CAAC;IACD,8EAA8E;IAC9E,KAAK,CAAC,IAAY;QAChB,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,+BAA+B;IAC/B,IAAI,CAAC,IAAY;QACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,2EAA2E;IAE3E;;;;;;OAMG;IACH,QAAQ,CAAC,GAAW,EAAE,KAAa;QACjC,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IAOD,MAAM,CACJ,YAA2C;QAE3C,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAChD,CAAC;IACD,+DAA+D;IAC/D,MAAM,CAAC,GAAW;QAChB,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACvC,CAAC;IAED,2EAA2E;IAE3E;;;;;;;;;;;;;;;;OAgBG;IACH,eAAe,CACb,IAAY,EACZ,MAAc,EACd,QAAiB,EACjB,IAA0B;QAE1B,OAAO,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACxE,CAAC;IAED,gFAAgF;IAChF,eAAe;QACb,OAAO,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IAED,2EAA2E;IAC3E,gBAAgB,CAAC,IAAY;QAC3B,OAAO,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IAED;;;;;OAKG;IACH,YAAY;QACV,OAAO,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;CACF"}

package/dist/credentials.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The credential vault and the account's sign-in preferences.
+ *
+ * The bodies of the `Unfenced` methods under `// ---- credential vault`, moved
+ * out with only `this.request` -> `http.request`. No method here ever returns a
+ * stored secret — that was true before the split and stays true after it.
+ */
+import { Transport } from "./http.js";
+import type { AccountPrefs, CredentialName } from "./types.js";
+export declare function storeCredential(http: Transport, name: string, secret: string, username?: string, kind?: "password" | "totp"): Promise<CredentialName>;
+export declare function credentialNames(http: Transport): Promise<CredentialName[]>;
+export declare function deleteCredential(http: Transport, name: string): Promise<boolean>;
+export declare function accountPrefs(http: Transport): Promise<AccountPrefs>;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE/D,wBAAgB,eAAe,CAC7B,IAAI,EAAE,SAAS,EACf,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,EACjB,IAAI,CAAC,EAAE,UAAU,GAAG,MAAM,GACzB,OAAO,CAAC,cAAc,CAAC,CAEzB;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAI1E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAIhF;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,CAEnE"}

package/dist/credentials.js

@@ -0,0 +1,17 @@
+export function storeCredential(http, name, secret, username, kind) {
+    return http.request("POST", "/vault", { name, secret, username, kind });
+}
+export function credentialNames(http) {
+    return http
+        .request("GET", "/vault")
+        .then((r) => r.credentials);
+}
+export function deleteCredential(http, name) {
+    return http
+        .request("DELETE", `/vault/${encodeURIComponent(name)}`)
+        .then((r) => r.removed);
+}
+export function accountPrefs(http) {
+    return http.request("GET", "/prefs").then((r) => r.prefs);
+}
+//# sourceMappingURL=credentials.js.map

package/dist/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAUA,MAAM,UAAU,eAAe,CAC7B,IAAe,EACf,IAAY,EACZ,MAAc,EACd,QAAiB,EACjB,IAA0B;IAE1B,OAAO,IAAI,CAAC,OAAO,CAAiB,MAAM,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAe;IAC7C,OAAO,IAAI;SACR,OAAO,CAAoC,KAAK,EAAE,QAAQ,CAAC;SAC3D,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAe,EAAE,IAAY;IAC5D,OAAO,IAAI;SACR,OAAO,CAAuB,QAAQ,EAAE,UAAU,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;SAC7E,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAe;IAC1C,OAAO,IAAI,CAAC,OAAO,CAA0B,KAAK,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AACrF,CAAC"}

package/dist/fetch.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The fetch tier of the client: one URL, a batch, and a batch on a deadline.
+ *
+ * These are the bodies of `Unfenced.fetch`/`batch`/`batchWithin`, moved out
+ * verbatim and re-shaped from methods to functions that take a `Transport`.
+ * `this.request` became `http.request`, `this.awaitJob` and `this.fetch` became
+ * the module-local `awaitJob` and `fetch` below; nothing else changed. The error
+ * helpers (`errorCodeOf`, `targetRejection`, `toFetchFailure`) live here because
+ * fetch is their only caller. URL identity is shared with the worker.
+ */
+import { Transport } from "./http.js";
+import type { FetchOptions, FetchResult } from "./types.js";
+export declare function fetch(http: Transport, url: string, options?: FetchOptions, retryBusy?: boolean, cancelOnTimeout?: boolean): Promise<FetchResult>;
+export declare function batch(http: Transport, urls: string[], options?: FetchOptions): Promise<FetchResult[]>;
+export declare function batchWithin(http: Transport, urls: string[], deadlineMs: number, options?: FetchOptions): Promise<FetchResult[]>;
+//# sourceMappingURL=fetch.d.ts.map

package/dist/fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../src/fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,SAAS,EAAmD,MAAM,WAAW,CAAC;AACvF,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AA+M5D,wBAAsB,KAAK,CACzB,IAAI,EAAE,SAAS,EACf,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,YAAiB,EAC1B,SAAS,UAAQ,EACjB,eAAe,UAAQ,GACtB,OAAO,CAAC,WAAW,CAAC,CA4FtB;AAED,wBAAsB,KAAK,CACzB,IAAI,EAAE,SAAS,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,WAAW,EAAE,CAAC,CAmCxB;AAED,wBAAsB,WAAW,CAC/B,IAAI,EAAE,SAAS,EACf,IAAI,EAAE,MAAM,EAAE,EACd,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,WAAW,EAAE,CAAC,CAsExB"}