@unfenced-ai/sdk 0.1.0

package/dist/http.js

@@ -0,0 +1,250 @@
+/** Sent as x-unfenced-client unless the caller overrides it. */
+const SDK_CLIENT = "unfenced-sdk";
+/** Keep unbudgeted session and account calls inside a normal client request window. */
+const DEFAULT_REQUEST_BUDGET_MS = 45_000;
+/**
+ * Raised for any non-2xx response, carrying the server's status and detail.
+ *
+ * `code` and `remedy` exist because the server's refusals are structured and the
+ * actionable half was being thrown away. The body arrives as
+ * `{error, detail, remedy}`; this used to store the raw text truncated to 300
+ * characters, which cut a longer refusal mid-string — so the JSON no longer
+ * parsed downstream, the caller got a blob of half-JSON as its "detail", and the
+ * `remedy` that says how to proceed was simply gone. A refusal an agent cannot
+ * read its way out of is an infinite loop, which is the failure the act-guard in
+ * core already paid for once.
+ */
+export class UnfencedError extends Error {
+    status;
+    detail;
+    /** The server's error code, e.g. `use-fetch`, when the body carried one. */
+    code;
+    /** What the server said to do instead. The half worth keeping. */
+    remedy;
+    /** Validated server delay in milliseconds; does not authorize retrying a write. */
+    retryAfterMs;
+    /** Original HTTP Retry-After value (delay-seconds or HTTP-date), when present. */
+    retryAfter;
+    constructor(status, detail, parts = {}) {
+        super(`unfenced ${status}: ${detail}${parts.remedy ? ` - ${parts.remedy}` : ""}`, {
+            ...(parts.cause !== undefined ? { cause: parts.cause } : {}),
+        });
+        this.status = status;
+        this.detail = detail;
+        this.name = "UnfencedError";
+        this.code = parts.code;
+        this.remedy = parts.remedy;
+        this.retryAfterMs = parts.retryAfterMs;
+        this.retryAfter = parts.retryAfter;
+    }
+}
+/**
+ * One signal from up to two, without needing `AbortSignal.any`.
+ *
+ * `AbortSignal.any` landed in Node 20 and is still absent from some runtimes
+ * this client is meant to run in, and a client whose whole pitch is "platform
+ * fetch, runs anywhere that has one" should not acquire a floor for a
+ * convenience. Returns the single signal when there is only one, so the common
+ * case allocates nothing.
+ */
+function combineSignals(a, b) {
+    const nothing = () => { };
+    if (!a)
+        return { signal: b, release: nothing };
+    if (!b)
+        return { signal: a, release: nothing };
+    const controller = new AbortController();
+    for (const s of [a, b]) {
+        if (s.aborted) {
+            controller.abort(s.reason);
+            return { signal: controller.signal, release: nothing };
+        }
+    }
+    // A controller whose only job is to take the two listeners off again.
+    //
+    // WHY IT HAS TO. `{once: true}` fires a listener once and removes it only
+    // when it FIRES; a request that succeeds never aborts, so both listeners
+    // stayed registered forever. One of the two signals is the per-request
+    // `AbortSignal.timeout`, which is garbage the moment the call returns — the
+    // other is the CLIENT's, which lives as long as the caller's task. So using
+    // the documented feature as documented ("Cancel every request this client
+    // makes") grew that signal's listener array by two per request and retained
+    // a closure with each: measured at 80 listeners after 40 successful calls,
+    // with nothing reporting it, because Node emits no MaxListenersExceeded
+    // warning for a bare AbortSignal.
+    //
+    // `signal` on addEventListener is the removal that cannot be forgotten: one
+    // `cleanup.abort()` in the request's `finally` detaches both.
+    const cleanup = new AbortController();
+    for (const s of [a, b]) {
+        s.addEventListener("abort", () => controller.abort(s.reason), {
+            once: true,
+            signal: cleanup.signal,
+        });
+    }
+    return { signal: controller.signal, release: () => cleanup.abort() };
+}
+export function parseErrorBody(text) {
+    try {
+        const body = JSON.parse(text);
+        if (!body || typeof body !== "object" || Array.isArray(body))
+            return null;
+        const fields = body;
+        return {
+            ...(typeof fields["error"] === "string" ? { error: fields["error"] } : {}),
+            ...(typeof fields["detail"] === "string" ? { detail: fields["detail"] } : {}),
+            ...(typeof fields["remedy"] === "string" ? { remedy: fields["remedy"] } : {}),
+            ...(typeof fields["retryAfterMs"] === "number" &&
+                Number.isSafeInteger(fields["retryAfterMs"]) &&
+                fields["retryAfterMs"] >= 0
+                ? { retryAfterMs: fields["retryAfterMs"] }
+                : {}),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/** Keep durations inside the timer range shared by supported runtimes. */
+export function validateDuration(value, name) {
+    if (!Number.isInteger(value) || value < 0 || value > 2_147_483_647) {
+        throw new RangeError(`${name} must be an integer from 0 to 2147483647 milliseconds`);
+    }
+}
+/** Sends requests; identity headers remain live by reference until submission. */
+export class Transport {
+    baseUrl;
+    apiKey;
+    /** Narrowed to what this client calls: a string URL and an init object. */
+    doFetch;
+    extraHeaders;
+    /** A caller's cancel for the whole client, combined with each call's budget. */
+    clientSignal;
+    constructor(options = {}) {
+        this.baseUrl = (options.baseUrl ?? "http://127.0.0.1:8787").replace(/\/$/, "");
+        this.apiKey = options.apiKey;
+        // Held BY REFERENCE, not copied. An MCP server passes an object it fills in
+        // later, once its peer identifies itself in `initialize` — copying here
+        // would freeze it empty and lose the client's name.
+        this.extraHeaders = options.headers ?? {};
+        this.clientSignal = options.signal;
+        const f = options.fetch ?? globalThis.fetch;
+        if (!f)
+            throw new Error("no fetch available - pass options.fetch");
+        this.doFetch = f.bind(globalThis);
+    }
+    /**
+     * Make a request, bounded.
+     *
+     * `budgetMs` is what is LEFT of the caller's `timeoutMs`, not a per-request
+     * allowance: `fetch()` computes a deadline once and hands each request the
+     * remainder, so ten polls cannot each take the whole budget. Nothing on this
+     * path carried a signal at all before — `grep -n AbortSignal packages/sdk`
+     * returned nothing — so `timeoutMs` bounded only the check between polls and
+     * a stalled connection wedged the call until the OS gave up.
+     */
+    async request(method, path, body, budgetMs, requestHeaders) {
+        const requestBudgetMs = budgetMs ?? DEFAULT_REQUEST_BUDGET_MS;
+        if (requestBudgetMs <= 0)
+            throw new UnfencedError(0, "request budget expired before submission", { code: "timeout" });
+        validateDuration(requestBudgetMs, "request budget");
+        // The default identity is applied per request, so a caller's object that
+        // gains a name after construction still overrides it. Node's fetch sends
+        // `user-agent: node`, so without this every SDK caller was anonymous.
+        const headers = {
+            "x-unfenced-client": SDK_CLIENT,
+            ...this.extraHeaders,
+            ...requestHeaders,
+        };
+        if (this.apiKey)
+            headers["authorization"] = `Bearer ${this.apiKey}`;
+        if (body !== undefined)
+            headers["content-type"] = "application/json";
+        const { signal, release } = combineSignals(this.clientSignal, 
+        // A budget already spent is a request that must not be made at all.
+        AbortSignal.timeout(requestBudgetMs));
+        // `release` runs once this call is completely done — after the body, not
+        // after the headers. Releasing at `doFetch`'s resolve would leave a client
+        // cancel unable to interrupt a slow body read, which is most of the wait on
+        // a large page.
+        try {
+            return await this.send(method, path, headers, body, signal);
+        }
+        finally {
+            release();
+        }
+    }
+    /** The request itself, so the listener teardown above is one `finally`. */
+    async send(method, path, headers, body, signal) {
+        let response;
+        try {
+            // Cancellation is our boundary too: an injected fetch implementation
+            // may ignore an already-aborted signal and still submit a write.
+            if (signal?.aborted)
+                throw signal.reason;
+            response = await this.doFetch(`${this.baseUrl}${path}`, {
+                method,
+                headers,
+                ...(signal ? { signal } : {}),
+                ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
+            });
+        }
+        catch (cause) {
+            // The commonest runtime failure for a hosted-service client — DNS gone,
+            // the worker down, a tunnel dropped, the deadline reached — reached the
+            // caller as a bare `TypeError: fetch failed` with no status, no code and
+            // no remedy, so the `catch (e) { if (e instanceof UnfencedError) }` shape
+            // the README teaches missed it entirely. Status 0 because nothing
+            // answered; `cause` is kept so the platform error is still readable.
+            const timedOut = signal?.aborted ||
+                (cause instanceof Error && (cause.name === "TimeoutError" || cause.name === "AbortError"));
+            throw new UnfencedError(0, cause instanceof Error ? cause.message : String(cause), timedOut
+                ? {
+                    code: "timeout",
+                    remedy: "No response arrived within the request budget. The request may already have been accepted; check its state before retrying a write, and verify service availability or timeoutMs.",
+                    cause,
+                }
+                : {
+                    code: "unreachable",
+                    remedy: "No response was received. Check baseUrl, the network, and service availability. The request may already have been accepted; check its state before retrying a write.",
+                    cause,
+                });
+        }
+        const retryAfter = response.headers?.get("retry-after") ?? undefined;
+        try {
+            if (!response.ok && response.status !== 202) {
+                const text = await response.text();
+                // Parse BEFORE truncating. Truncating first cut a structured refusal
+                // mid-JSON, so nothing downstream could read it back and the `remedy` —
+                // the only part that tells the caller what to do instead — was lost.
+                const body = parseErrorBody(text);
+                throw new UnfencedError(response.status, body?.detail ?? text.slice(0, 300), {
+                    ...(body?.error ? { code: body.error } : {}),
+                    ...(body?.remedy ? { remedy: body.remedy } : {}),
+                    ...(body?.retryAfterMs !== undefined ? { retryAfterMs: body.retryAfterMs } : {}),
+                    ...(retryAfter !== undefined ? { retryAfter } : {}),
+                });
+            }
+            return (await response.json());
+        }
+        catch (cause) {
+            if (cause instanceof UnfencedError)
+                throw cause;
+            // Headers do not complete the request. A stalled/truncated body must
+            // follow the same structured failure contract as a failed connection.
+            const timedOut = signal?.aborted ||
+                (cause instanceof Error && (cause.name === "TimeoutError" || cause.name === "AbortError"));
+            throw new UnfencedError(response.status, "The response body could not be read", {
+                ...(retryAfter !== undefined ? { retryAfter } : {}),
+                code: timedOut
+                    ? "timeout"
+                    : cause instanceof SyntaxError
+                        ? "invalid-response"
+                        : "unreachable",
+                remedy: "The request may already have been accepted. Check its state before retrying a write; verify service availability and the response format.",
+                cause,
+            });
+        }
+    }
+}
+//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAaA,gEAAgE;AAChE,MAAM,UAAU,GAAG,cAAc,CAAC;AAClC,uFAAuF;AACvF,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,aAAc,SAAQ,KAAK;IAWpB;IACA;IAXlB,4EAA4E;IAC5D,IAAI,CAAqB;IACzC,kEAAkE;IAClD,MAAM,CAAqB;IAC3C,mFAAmF;IACnE,YAAY,CAAqB;IACjD,kFAAkF;IAClE,UAAU,CAAqB;IAE/C,YACkB,MAAc,EACd,MAAc,EAC9B,QAMI,EAAE;QAEN,KAAK,CAAC,YAAY,MAAM,KAAK,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE;YAChF,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,CAAC,CAAC;QAZa,WAAM,GAAN,MAAM,CAAQ;QACd,WAAM,GAAN,MAAM,CAAQ;QAY9B,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;QACvC,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACrC,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc,CACrB,CAA0B,EAC1B,CAA0B;IAE1B,MAAM,OAAO,GAAG,GAAS,EAAE,GAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC/C,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YACd,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC3B,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QACzD,CAAC;IACH,CAAC;IACD,sEAAsE;IACtE,EAAE;IACF,0EAA0E;IAC1E,yEAAyE;IACzE,uEAAuE;IACvE,4EAA4E;IAC5E,4EAA4E;IAC5E,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,wEAAwE;IACxE,kCAAkC;IAClC,EAAE;IACF,4EAA4E;IAC5E,8DAA8D;IAC9D,MAAM,OAAO,GAAG,IAAI,eAAe,EAAE,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACvB,CAAC,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE;YAC5D,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,IAAY;IAEZ,IAAI,CAAC;QACH,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1E,MAAM,MAAM,GAAG,IAA+B,CAAC;QAC/C,OAAO;YACL,GAAG,CAAC,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,GAAG,CAAC,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,GAAG,CAAC,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,GAAG,CAAC,OAAO,MAAM,CAAC,cAAc,CAAC,KAAK,QAAQ;gBAC9C,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;gBAC5C,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC;gBACzB,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE;gBAC1C,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,IAAY;IAC1D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,aAAa,EAAE,CAAC;QACnE,MAAM,IAAI,UAAU,CAAC,GAAG,IAAI,uDAAuD,CAAC,CAAC;IACvF,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,OAAO,SAAS;IACH,OAAO,CAAS;IAChB,MAAM,CAAqB;IAC5C,2EAA2E;IAC1D,OAAO,CAAyD;IAChE,YAAY,CAAyB;IACtD,gFAAgF;IAC/D,YAAY,CAA0B;IAEvD,YAAY,UAA2B,EAAE;QACvC,IAAI,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,uBAAuB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,4EAA4E;QAC5E,wEAAwE;QACxE,oDAAoD;QACpD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QAC1C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;QACnC,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;QAC5C,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACnE,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,OAAO,CACX,MAAc,EACd,IAAY,EACZ,IAAc,EACd,QAAiB,EACjB,cAAuC;QAEvC,MAAM,eAAe,GAAG,QAAQ,IAAI,yBAAyB,CAAC;QAC9D,IAAI,eAAe,IAAI,CAAC;YACtB,MAAM,IAAI,aAAa,CAAC,CAAC,EAAE,0CAA0C,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9F,gBAAgB,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC;QACpD,yEAAyE;QACzE,yEAAyE;QACzE,sEAAsE;QACtE,MAAM,OAAO,GAA2B;YACtC,mBAAmB,EAAE,UAAU;YAC/B,GAAG,IAAI,CAAC,YAAY;YACpB,GAAG,cAAc;SAClB,CAAC;QACF,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,eAAe,CAAC,GAAG,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC;QACpE,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QACrE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CACxC,IAAI,CAAC,YAAY;QACjB,oEAAoE;QACpE,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC,CACrC,CAAC;QACF,yEAAyE;QACzE,2EAA2E;QAC3E,4EAA4E;QAC5E,gBAAgB;QAChB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,IAAI,CAAI,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACjE,CAAC;gBAAS,CAAC;YACT,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,2EAA2E;IACnE,KAAK,CAAC,IAAI,CAChB,MAAc,EACd,IAAY,EACZ,OAA+B,EAC/B,IAAa,EACb,MAA+B;QAE/B,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,qEAAqE;YACrE,iEAAiE;YACjE,IAAI,MAAM,EAAE,OAAO;gBAAE,MAAM,MAAM,CAAC,MAAM,CAAC;YACzC,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;gBACtD,MAAM;gBACN,OAAO;gBACP,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7B,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,wEAAwE;YACxE,yEAAyE;YACzE,0EAA0E;YAC1E,kEAAkE;YAClE,qEAAqE;YACrE,MAAM,QAAQ,GACZ,MAAM,EAAE,OAAO;gBACf,CAAC,KAAK,YAAY,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC;YAC7F,MAAM,IAAI,aAAa,CACrB,CAAC,EACD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EACtD,QAAQ;gBACN,CAAC,CAAC;oBACE,IAAI,EAAE,SAAS;oBACf,MAAM,EACJ,mLAAmL;oBACrL,KAAK;iBACN;gBACH,CAAC,CAAC;oBACE,IAAI,EAAE,aAAa;oBACnB,MAAM,EACJ,sKAAsK;oBACxK,KAAK;iBACN,CACN,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC;QACrE,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACnC,qEAAqE;gBACrE,wEAAwE;gBACxE,qEAAqE;gBACrE,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;gBAClC,MAAM,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;oBAC3E,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5C,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChD,GAAG,CAAC,IAAI,EAAE,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChF,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACpD,CAAC,CAAC;YACL,CAAC;YACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAM,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,aAAa;gBAAE,MAAM,KAAK,CAAC;YAChD,qEAAqE;YACrE,sEAAsE;YACtE,MAAM,QAAQ,GACZ,MAAM,EAAE,OAAO;gBACf,CAAC,KAAK,YAAY,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC;YAC7F,MAAM,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,qCAAqC,EAAE;gBAC9E,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnD,IAAI,EAAE,QAAQ;oBACZ,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,KAAK,YAAY,WAAW;wBAC5B,CAAC,CAAC,kBAAkB;wBACpB,CAAC,CAAC,aAAa;gBACnB,MAAM,EACJ,2IAA2I;gBAC7I,KAAK;aACN,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,53 @@
+/**
+ * The unfenced SDK — a typed client for the unfenced server.
+ *
+ * unfenced fetches any page as clean, agent-ready content and drives a real
+ * browser (observe, click, type, extract) from the machine the server runs on,
+ * using that machine's IP and logged-in cookies. This client is how code talks
+ * to it: point it at a running server, and you get fetch, live sessions, and
+ * the recorded-session library, all typed. Zero dependencies — it uses the
+ * platform `fetch`.
+ *
+ * Node 22.12 or newer. This comment shipped inside the published `.d.ts` saying
+ * "Node 20+ and in the browser alike", which is what a customer's editor showed
+ * on hover, and both halves were false: the manifest has never been tested
+ * below 22, and `exports` now declares a `require` condition that Node loads
+ * through require(esm) only from 22.12. The browser half is contradicted by the
+ * README two paragraphs down — every request carries an `x-unfenced-client`
+ * header, which is not CORS-safelisted, so a cross-origin call preflights and
+ * the worker does not answer it.
+ *
+ *   const ac = new Unfenced({ baseUrl: "http://127.0.0.1:8787", apiKey });
+ *   const page = await ac.fetch("https://example.com");        // clean markdown
+ *   const s = await ac.open("https://news.ycombinator.com");   // a live browser
+ *   const snap = await s.observe();                            // what's on it
+ *   await s.click(snap.controls[0].ref);                       // do things
+ *   await s.close();
+ *
+ * This file is the package entry and now a thin barrel: the client class lives
+ * in `./client.ts`, the `Session` handle in `./session.ts`, the domain and wire
+ * types in `./types.ts` and `./protocol.ts`, and the request bodies in the
+ * per-concern modules those two classes call (`fetch`, `sessions`, `library`,
+ * `permissions`, `memory`, `credentials`, over a shared `http` transport). Every
+ * name below was exported from here before the split and is re-exported from
+ * here unchanged — no consumer import needs to move.
+ */
+/**
+ * The wire shapes live in `./protocol.js` and are re-exported here.
+ *
+ * They were declared inline until three copies of `ExtractedDoc` had drifted
+ * apart across this package, `@unfenced/extract` and the dashboard. `protocol`
+ * imports nothing and holds no runtime code beyond two field lists, so a client
+ * that only wants the types — the dashboard, which may not take a runtime
+ * dependency on any `@unfenced/*` package — can `import type` from it without
+ * pulling this class in behind it.
+ */
+export type { Alternate, AlternateKind, ContentConfidence, Cost, EscalationRecord, ExtractedDoc, ExtractionMethod, FetchFailureMeta, FetchMeta, ImageRef, LinkRef, Meter, OutputFormat, PageType, StructuredDataKind, StructuredDatum, Tier, TokenEstimate, } from "./protocol.js";
+export { WIRE_DOC_FIELDS, WIRE_META_FIELDS } from "./protocol.js";
+export type { AccountPrefs, ActCode, ActEvidence, ActEvidenceKind, ActExpectation, Action, ActResult, AtAction, CredentialName, DownloadInfo, Fault, FetchOptions, FetchResult, Format, FormField, FormFillResult, InterruptKind, MediaItem, MemoryEntry, MemoryRecallOptions, Offer, OnAction, PageChanges, PageSnapshot, PendingApproval, PermissionsAnswer, ProviderSessionReason, ReadPage, SeenPage, SessionDetail, SessionInfo, SessionStep, SessionSummary, ConnectionSnapshot, SitePref, SnapshotElement, Spot, UnfencedOptions, } from "./types.js";
+export { UnfencedError } from "./http.js";
+export { Unfenced } from "./client.js";
+export { urlIdentity } from "./url-identity.js";
+export { toolTokenUsage, type TokenUsage } from "./token-usage.js";
+export { Session, type SessionActOptions } from "./session.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH;;;;;;;;;GASG;AACH,YAAY,EACV,SAAS,EACT,aAAa,EACb,iBAAiB,EACjB,IAAI,EACJ,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,SAAS,EACT,QAAQ,EACR,OAAO,EACP,KAAK,EACL,YAAY,EACZ,QAAQ,EACR,kBAAkB,EAClB,eAAe,EACf,IAAI,EACJ,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAElE,YAAY,EACV,YAAY,EACZ,OAAO,EACP,WAAW,EACX,eAAe,EACf,cAAc,EACd,MAAM,EACN,SAAS,EACT,QAAQ,EACR,cAAc,EACd,YAAY,EACZ,KAAK,EACL,YAAY,EACZ,WAAW,EACX,MAAM,EACN,SAAS,EACT,cAAc,EACd,aAAa,EACb,SAAS,EACT,WAAW,EACX,mBAAmB,EACnB,KAAK,EACL,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,QAAQ,EACR,QAAQ,EACR,aAAa,EACb,WAAW,EACX,WAAW,EACX,cAAc,EACd,kBAAkB,EAClB,QAAQ,EACR,eAAe,EACf,IAAI,EACJ,eAAe,GAChB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -0,0 +1,41 @@
+/**
+ * The unfenced SDK — a typed client for the unfenced server.
+ *
+ * unfenced fetches any page as clean, agent-ready content and drives a real
+ * browser (observe, click, type, extract) from the machine the server runs on,
+ * using that machine's IP and logged-in cookies. This client is how code talks
+ * to it: point it at a running server, and you get fetch, live sessions, and
+ * the recorded-session library, all typed. Zero dependencies — it uses the
+ * platform `fetch`.
+ *
+ * Node 22.12 or newer. This comment shipped inside the published `.d.ts` saying
+ * "Node 20+ and in the browser alike", which is what a customer's editor showed
+ * on hover, and both halves were false: the manifest has never been tested
+ * below 22, and `exports` now declares a `require` condition that Node loads
+ * through require(esm) only from 22.12. The browser half is contradicted by the
+ * README two paragraphs down — every request carries an `x-unfenced-client`
+ * header, which is not CORS-safelisted, so a cross-origin call preflights and
+ * the worker does not answer it.
+ *
+ *   const ac = new Unfenced({ baseUrl: "http://127.0.0.1:8787", apiKey });
+ *   const page = await ac.fetch("https://example.com");        // clean markdown
+ *   const s = await ac.open("https://news.ycombinator.com");   // a live browser
+ *   const snap = await s.observe();                            // what's on it
+ *   await s.click(snap.controls[0].ref);                       // do things
+ *   await s.close();
+ *
+ * This file is the package entry and now a thin barrel: the client class lives
+ * in `./client.ts`, the `Session` handle in `./session.ts`, the domain and wire
+ * types in `./types.ts` and `./protocol.ts`, and the request bodies in the
+ * per-concern modules those two classes call (`fetch`, `sessions`, `library`,
+ * `permissions`, `memory`, `credentials`, over a shared `http` transport). Every
+ * name below was exported from here before the split and is re-exported from
+ * here unchanged — no consumer import needs to move.
+ */
+export { WIRE_DOC_FIELDS, WIRE_META_FIELDS } from "./protocol.js";
+export { UnfencedError } from "./http.js";
+export { Unfenced } from "./client.js";
+export { urlIdentity } from "./url-identity.js";
+export { toolTokenUsage } from "./token-usage.js";
+export { Session } from "./session.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAgCH,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AA2ClE,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAmB,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,OAAO,EAA0B,MAAM,cAAc,CAAC"}

package/dist/library.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The recorded-session library and the two raw logs beside it.
+ *
+ * The bodies of the `Unfenced` methods under `// ---- library & memory`, moved
+ * out unchanged save for `this.request` becoming `http.request`.
+ */
+import { Transport } from "./http.js";
+import type { SessionDetail, SessionSummary } from "./types.js";
+export declare function sessions(http: Transport, query?: {
+    kind?: string;
+    q?: string;
+    limit?: number;
+}): Promise<SessionSummary[]>;
+export declare function recordedSession(http: Transport, id: string): Promise<SessionDetail>;
+export declare function history(http: Transport, limit?: number): Promise<unknown[]>;
+export declare function domains(http: Transport): Promise<unknown[]>;
+//# sourceMappingURL=library.d.ts.map

package/dist/library.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"library.d.ts","sourceRoot":"","sources":["../src/library.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEhE,wBAAgB,QAAQ,CACtB,IAAI,EAAE,SAAS,EACf,KAAK,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GACxD,OAAO,CAAC,cAAc,EAAE,CAAC,CAS3B;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAEnF;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,SAAK,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAIvE;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAE3D"}

package/dist/library.js

@@ -0,0 +1,25 @@
+export function sessions(http, query = {}) {
+    const p = new URLSearchParams();
+    if (query.kind)
+        p.set("kind", query.kind);
+    if (query.q)
+        p.set("q", query.q);
+    if (query.limit)
+        p.set("limit", String(query.limit));
+    const qs = p.toString();
+    return http
+        .request("GET", `/sessions${qs ? `?${qs}` : ""}`)
+        .then((r) => r.sessions);
+}
+export function recordedSession(http, id) {
+    return http.request("GET", `/sessions/${id}`).then((r) => r.session);
+}
+export function history(http, limit = 50) {
+    return http
+        .request("GET", `/history?limit=${limit}`)
+        .then((r) => r.entries);
+}
+export function domains(http) {
+    return http.request("GET", "/domains").then((r) => r.domains);
+}
+//# sourceMappingURL=library.js.map

package/dist/library.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"library.js","sourceRoot":"","sources":["../src/library.ts"],"names":[],"mappings":"AASA,MAAM,UAAU,QAAQ,CACtB,IAAe,EACf,QAAuD,EAAE;IAEzD,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;IAChC,IAAI,KAAK,CAAC,IAAI;QAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,KAAK,CAAC,CAAC;QAAE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,KAAK;QAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACrD,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxB,OAAO,IAAI;SACR,OAAO,CAAiC,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;SAChF,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAe,EAAE,EAAU;IACzD,OAAO,IAAI,CAAC,OAAO,CAA6B,KAAK,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AACnG,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAe,EAAE,KAAK,GAAG,EAAE;IACjD,OAAO,IAAI;SACR,OAAO,CAAyB,KAAK,EAAE,kBAAkB,KAAK,EAAE,CAAC;SACjE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAe;IACrC,OAAO,IAAI,CAAC,OAAO,CAAyB,KAAK,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AACxF,CAAC"}

package/dist/memory.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The agent's task-memory scratchpad: remember, recall, forget.
+ *
+ * The bodies of the `Unfenced` methods under `// ---- task memory`, moved out
+ * with only `this.request` -> `http.request`. `recall` is one function here; the
+ * two public overloads stay declared on the `Unfenced` class.
+ */
+import { Transport } from "./http.js";
+import type { MemoryEntry, MemoryRecallOptions } from "./types.js";
+export declare function remember(http: Transport, key: string, value: string): Promise<MemoryEntry>;
+export declare function recall(http: Transport, keyOrOptions?: string | MemoryRecallOptions): Promise<MemoryEntry | MemoryEntry[] | undefined>;
+export declare function forget(http: Transport, key: string): Promise<boolean>;
+//# sourceMappingURL=memory.d.ts.map

package/dist/memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../src/memory.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,SAAS,EAAiB,MAAM,WAAW,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEnE,wBAAgB,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAI1F;AAED,wBAAgB,MAAM,CACpB,IAAI,EAAE,SAAS,EACf,YAAY,CAAC,EAAE,MAAM,GAAG,mBAAmB,GAC1C,OAAO,CAAC,WAAW,GAAG,WAAW,EAAE,GAAG,SAAS,CAAC,CAsBlD;AAED,wBAAgB,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAIrE"}

package/dist/memory.js

@@ -0,0 +1,45 @@
+/**
+ * The agent's task-memory scratchpad: remember, recall, forget.
+ *
+ * The bodies of the `Unfenced` methods under `// ---- task memory`, moved out
+ * with only `this.request` -> `http.request`. `recall` is one function here; the
+ * two public overloads stay declared on the `Unfenced` class.
+ */
+import { UnfencedError } from "./http.js";
+export function remember(http, key, value) {
+    return http
+        .request("POST", "/memory", { key, value })
+        .then((r) => r.entry);
+}
+export function recall(http, keyOrOptions) {
+    if (keyOrOptions === undefined || typeof keyOrOptions === "object") {
+        const options = keyOrOptions;
+        const query = new URLSearchParams();
+        if (options?.prefix)
+            query.set("prefix", options.prefix);
+        if (options?.limit !== undefined)
+            query.set("limit", String(options.limit));
+        const suffix = query.toString() ? `?${query.toString()}` : "";
+        return http
+            .request("GET", `/memory${suffix}`)
+            .then((r) => r.entries);
+    }
+    const key = keyOrOptions;
+    return http
+        .request("GET", `/memory/${encodeURIComponent(key)}`)
+        .then((r) => r.entry)
+        .catch((error) => {
+        // A missing key is a 404 — an absence, not an error. Answer `undefined`
+        // so a caller can ask "do I have this?" without a try/catch, the same
+        // way `get` does on the store.
+        if (error instanceof UnfencedError && error.status === 404)
+            return undefined;
+        throw error;
+    });
+}
+export function forget(http, key) {
+    return http
+        .request("DELETE", `/memory/${encodeURIComponent(key)}`)
+        .then((r) => r.removed);
+}
+//# sourceMappingURL=memory.js.map

package/dist/memory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.js","sourceRoot":"","sources":["../src/memory.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAa,aAAa,EAAE,MAAM,WAAW,CAAC;AAGrD,MAAM,UAAU,QAAQ,CAAC,IAAe,EAAE,GAAW,EAAE,KAAa;IAClE,OAAO,IAAI;SACR,OAAO,CAAyB,MAAM,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;SAClE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,MAAM,CACpB,IAAe,EACf,YAA2C;IAE3C,IAAI,YAAY,KAAK,SAAS,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;QACnE,MAAM,OAAO,GAAG,YAAY,CAAC;QAC7B,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,OAAO,EAAE,MAAM;YAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACzD,IAAI,OAAO,EAAE,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,OAAO,IAAI;aACR,OAAO,CAA6B,KAAK,EAAE,UAAU,MAAM,EAAE,CAAC;aAC9D,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC;IACzB,OAAO,IAAI;SACR,OAAO,CAAyB,KAAK,EAAE,WAAW,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;SAC5E,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;SACpB,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACf,wEAAwE;QACxE,sEAAsE;QACtE,+BAA+B;QAC/B,IAAI,KAAK,YAAY,aAAa,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAS,CAAC;QAC7E,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,IAAe,EAAE,GAAW;IACjD,OAAO,IAAI;SACR,OAAO,CAAuB,QAAQ,EAAE,WAAW,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;SAC7E,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AAC5B,CAAC"}

package/dist/permissions.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The act-allowlist tier: what the agent may act on, and links to change it.
+ *
+ * The bodies of the `Unfenced` methods under `// ---- act-allowlist`, moved out
+ * with only `this.request` -> `http.request`. `unreadableAllowlist` lives here
+ * because these are its only callers.
+ */
+import { Transport } from "./http.js";
+export declare function permissions(http: Transport): Promise<string[]>;
+export declare function permissionScope(http: Transport): Promise<{
+    entries: Array<{
+        host: string;
+        mode: "free" | "approve" | "read";
+    }>;
+    anySite: boolean;
+    excludedSites: string[];
+    allowSiteRequests?: boolean;
+}>;
+export declare function permissionEntries(http: Transport): Promise<Array<{
+    host: string;
+    mode: "free" | "approve" | "read";
+}>>;
+export declare function connectLink(http: Transport, host: string, opts?: {
+    label?: string;
+    mode?: "credential" | "permission";
+}): Promise<string>;
+export declare function allow(http: Transport, site: string): Promise<string>;
+export declare function deny(http: Transport, site: string): Promise<boolean>;
+//# sourceMappingURL=permissions.d.ts.map

package/dist/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAatC,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAS9D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC;IACxD,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAA;KAAE,CAAC,CAAC;IACpE,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B,CAAC,CAuBD;AAED,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,SAAS,GACd,OAAO,CAAC,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAA;CAAE,CAAC,CAAC,CAcrE;AAED,wBAAgB,WAAW,CACzB,IAAI,EAAE,SAAS,EACf,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,YAAY,GAAG,YAAY,CAAA;CAAO,GAChE,OAAO,CAAC,MAAM,CAAC,CAOjB;AAED,wBAAgB,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEpE;AAED,wBAAgB,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAIpE"}

package/dist/permissions.js

@@ -0,0 +1,69 @@
+/** Why the list could not be read, in words a caller can hand to a person. */
+function unreadableAllowlist(detail) {
+    return ("the act-allowlist could not be read, so which sites the agent may act on is unknown" +
+        (detail ? `: ${detail}` : "") +
+        ". This is NOT a refusal by the owner - acting fails closed until it can be read again, " +
+        "so treat it as a transient fault and retry, not as policy.");
+}
+export function permissions(http) {
+    // THROWS when the list could not be read, deliberately. The route omits
+    // `allowed` rather than sending [] when the store is unreachable, because an
+    // empty array is indistinguishable from "you granted nothing" — and an agent
+    // that reads an outage as policy stops asking for the grant it needs.
+    return http.request("GET", "/permissions").then((r) => {
+        if (!r.allowed)
+            throw new Error(unreadableAllowlist(r.detail));
+        return r.allowed;
+    });
+}
+export function permissionScope(http) {
+    return http
+        .request("GET", "/permissions")
+        .then((r) => {
+        const anySite = r.anySite === true;
+        const excludedSites = r.excludedSites ?? [];
+        const policy = r.allowSiteRequests === false ? { allowSiteRequests: false } : {};
+        if (r.entries)
+            return { entries: r.entries, anySite, excludedSites, ...policy };
+        if (!r.allowed)
+            throw new Error(unreadableAllowlist(r.detail));
+        return {
+            entries: r.allowed.map((host) => ({ host, mode: "free" })),
+            anySite,
+            excludedSites,
+            ...policy,
+        };
+    });
+}
+export function permissionEntries(http) {
+    return http
+        .request("GET", "/permissions")
+        .then((r) => {
+        // Same refusal as permissions(). Without it this line is `undefined.map`,
+        // which is loud but tells the caller nothing it can act on.
+        if (r.entries)
+            return r.entries;
+        if (!r.allowed)
+            throw new Error(unreadableAllowlist(r.detail));
+        return r.allowed.map((host) => ({ host, mode: "free" }));
+    });
+}
+export function connectLink(http, host, opts = {}) {
+    const q = new URLSearchParams({ host });
+    if (opts.label)
+        q.set("label", opts.label);
+    if (opts.mode)
+        q.set("mode", opts.mode);
+    return http
+        .request("GET", `/connect-link?${q.toString()}`)
+        .then((r) => r.setupUrl);
+}
+export function allow(http, site) {
+    return http.request("POST", "/permissions", { site }).then((r) => r.allowed);
+}
+export function deny(http, site) {
+    return http
+        .request("DELETE", `/permissions/${encodeURIComponent(site)}`)
+        .then((r) => r.removed);
+}
+//# sourceMappingURL=permissions.js.map

package/dist/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAUA,8EAA8E;AAC9E,SAAS,mBAAmB,CAAC,MAAe;IAC1C,OAAO,CACL,qFAAqF;QACrF,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,yFAAyF;QACzF,4DAA4D,CAC7D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAe;IACzC,wEAAwE;IACxE,6EAA6E;IAC7E,6EAA6E;IAC7E,sEAAsE;IACtE,OAAO,IAAI,CAAC,OAAO,CAAoB,KAAK,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACvE,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,CAAC,OAAO,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAe;IAM7C,OAAO,IAAI;SACR,OAAO,CAOL,KAAK,EAAE,cAAc,CAAC;SACxB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACV,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC;QACnC,MAAM,aAAa,GAAG,CAAC,CAAC,aAAa,IAAI,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,CAAC,CAAC,iBAAiB,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,IAAI,CAAC,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,MAAM,EAAE,CAAC;QAChF,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/D,OAAO;YACL,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAe,EAAE,CAAC,CAAC;YACnE,OAAO;YACP,aAAa;YACb,GAAG,MAAM;SACV,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,IAAe;IAEf,OAAO,IAAI;SACR,OAAO,CAIL,KAAK,EAAE,cAAc,CAAC;SACxB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACV,0EAA0E;QAC1E,4DAA4D;QAC5D,IAAI,CAAC,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAe,EAAE,CAAC,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,IAAe,EACf,IAAY,EACZ,OAA+D,EAAE;IAEjE,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,KAAK;QAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,IAAI,CAAC,IAAI;QAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,IAAI;SACR,OAAO,CAAuB,KAAK,EAAE,iBAAiB,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,IAAe,EAAE,IAAY;IACjD,OAAO,IAAI,CAAC,OAAO,CAAsB,MAAM,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AACpG,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,IAAe,EAAE,IAAY;IAChD,OAAO,IAAI;SACR,OAAO,CAAuB,QAAQ,EAAE,gBAAgB,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;SACnF,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AAC5B,CAAC"}