unfazed 0.0.1 → 0.2.0

package/schema/schema.graphqls

@@ -0,0 +1,1303 @@
+scalar File
+scalar JSON
+
+type Function {
+  id: ID!
+  name: String!
+  filename: String!
+  sizeBytes: Int!
+  sha256: String!
+  createdAt: String!
+  bundled: Boolean!
+}
+
+enum DeploymentKind {
+  STATIC
+  SERVICE
+  "A persistent always-on Linux VM with a per-workspace data disk (docs/agent-box.md)."
+  BOX
+}
+
+enum DeploymentStatus {
+  BUILDING
+  READY
+  FAILED
+}
+
+enum ServiceMode {
+  "Default. Sleeps and cold-starts a VM on the first request, then parks it after a short idle period — cheap and right for most services. Use on_demand + cronSchedule for periodic work."
+  ON_DEMAND
+  "Keeps a supervised VM running 24/7 (resource-expensive). Reserve for services that must stay warm (low first-request latency), do background work between requests, or run a frequent cron."
+  ALWAYS_ON
+}
+
+enum ServiceRuntime {
+  "Default. Bundles a TypeScript/JavaScript entry (server.ts) into a Bun HTTP server."
+  BUN
+  "Compiles a Go module (go.mod) into a static binary that starts its own HTTP server on $PORT."
+  GO
+}
+
+enum DeploymentEventType {
+  UNKNOWN
+  DEPLOYMENT_CREATED
+  DEPLOYMENT_PROMOTION_REJECTED
+  DEPLOYMENT_ROLLED_BACK
+  SERVICE_BUILD_FAILED
+  SERVICE_BUILD_SUCCEEDED
+  SERVICE_BOOT_FAILED
+  SERVICE_HEALTH_PROBE_FAILED
+  SERVICE_PROXY_ERROR
+  SERVICE_SUPERVISOR_STARTED
+  SERVICE_RESTART_REQUESTED
+  SERVICE_VM_START_FAILED
+  SERVICE_STOP_REQUESTED
+  SERVICE_SUPERVISOR_STOPPED
+  SERVICE_WATCHDOG_PROBE_FAILED
+  SERVICE_WATCHDOG_RESTART
+  SERVICE_VM_STARTED
+  SERVICE_VM_STOPPED
+  SERVICE_CRON_TRIGGERED
+}
+
+enum DeploymentEventSeverity {
+  INFO
+  WARN
+  ERROR
+}
+
+type Workspace {
+  id: ID!
+  name: String!
+  "Who owns this source. The listing includes the sources of agents the caller claimed, so this is how a client tells its own from an agent's: it matches one of whoami.linkedAgents[].agentID for the latter. Operations that require a DIRECTLY owned source — alias adoption targets — must filter on it."
+  ownerId: ID!
+  "The owner-defined project this app is grouped under (dashboard organization only); null when ungrouped."
+  projectId: ID
+  gitSource: GitSource
+  createdAt: String!
+  updatedAt: String!
+}
+
+"A project groups an owner's apps under a human-chosen name. Purely a dashboard organization layer: it does not affect app URLs or aliases, and is never exposed to agents."
+type Project {
+  id: ID!
+  name: String!
+  "The owning identity (github:<login>); the dashboard uses it to tell own projects from team-shared ones."
+  owner: String!
+  createdAt: String!
+  updatedAt: String!
+}
+
+input CreateProjectInput {
+  name: String!
+}
+
+input RenameProjectInput {
+  id: ID!
+  name: String!
+}
+
+input DeleteProjectInput {
+  id: ID!
+}
+
+input AssignWorkspaceToProjectInput {
+  workspaceID: ID!
+  "Target project; pass null or omit to ungroup the workspace."
+  projectId: ID
+}
+
+type ProjectPayload {
+  project: Project!
+}
+
+"A team: a named audience SELECTED projects are shared with (docs/teams.md). Membership alone shows nothing — members see exactly the projects shared with the team, their apps, and those apps' integrations (still running on the app owner's connections)."
+type Team {
+  id: ID!
+  name: String!
+  createdAt: String!
+  "The caller's role on this team: owner or member."
+  viewerRole: String!
+  members: [TeamMember!]!
+  "Pending invitations; they grant nothing until accepted."
+  invites: [TeamInvite!]!
+  "Projects shared with this team."
+  projects: [TeamSharedProject!]!
+  "Recent membership events, oldest first — who invited/removed/joined/shared, the audit-trail seed."
+  events: [TeamEvent!]!
+}
+
+type TeamSharedProject {
+  projectID: ID!
+  name: String!
+  sharedBy: String!
+  sharedByName: String!
+}
+
+type TeamMember {
+  userID: String!
+  "Bare github login for display."
+  name: String!
+  role: String!
+  addedAt: String!
+}
+
+type TeamInvite {
+  userID: String!
+  name: String!
+  invitedBy: String!
+  invitedByName: String!
+  invitedAt: String!
+}
+
+type TeamEvent {
+  at: String!
+  actor: String!
+  actorName: String!
+  "created | renamed | invited | invite_cancelled | invite_declined | joined | member_removed | member_left"
+  action: String!
+  subject: String
+  subjectName: String
+}
+
+"A pending invite addressed to the caller."
+type TeamInviteForMe {
+  teamID: ID!
+  teamName: String!
+  invitedBy: String!
+  invitedByName: String!
+  invitedAt: String!
+}
+
+input CreateTeamInput {
+  name: String!
+}
+
+input RenameTeamInput {
+  id: ID!
+  name: String!
+}
+
+input TeamIDInput {
+  teamID: ID!
+}
+
+input TeamInviteInput {
+  teamID: ID!
+  "GitHub login to invite, with or without a leading @."
+  login: String!
+}
+
+input TeamMemberInput {
+  teamID: ID!
+  userID: String!
+}
+
+input TeamProjectInput {
+  teamID: ID!
+  projectID: ID!
+}
+
+type TeamPayload {
+  team: Team!
+}
+
+"A BYO custom domain attached to an app's alias. The edge issues its TLS cert (Let's Encrypt) once active; requests to the domain serve the app."
+type CustomDomain {
+  domain: String!
+  alias: String!
+  "True once the platform allows the edge to issue a cert and route the domain."
+  active: Boolean!
+  createdAt: String!
+}
+
+"A public key that may authenticate to the box SSH gateway. Public keys are not secrets, so the fingerprint and type are shown in full."
+type SSHKey {
+  "OpenSSH SHA-256 fingerprint (the string ssh-keygen -lf prints). Also the id used to remove the key."
+  id: ID!
+  "Key algorithm, e.g. ssh-ed25519."
+  type: String!
+  "Trailing comment from the authorized_keys line, usually user@host."
+  comment: String
+  "Where the key came from: \"github\" when imported from the account's published GitHub keys, null when the user added it."
+  source: String
+  createdAt: String!
+}
+
+input AddSSHKeyInput {
+  "One authorized_keys line: \"<type> <base64> [comment]\". Never a private key."
+  publicKey: String!
+}
+
+input RemoveSSHKeyInput {
+  "Fingerprint from the sshKeys query."
+  id: ID!
+}
+
+input AddCustomDomainInput {
+  "The app alias the domain should serve."
+  alias: String!
+  domain: String!
+}
+
+input RemoveCustomDomainInput {
+  domain: String!
+}
+
+type GitSource {
+  provider: String!
+  repo: String!
+  branch: String!
+  repoURL: String!
+  autoDeploy: Boolean!
+  "The alias a push/webhook (or syncRepo) auto-deploys to. Empty means no fixed target."
+  deployAlias: String
+  subdir: String
+  lastImportedCommit: String
+  lastImportedAt: String
+  lastImportStatus: String!
+  lastImportError: String
+  webhookURL: String
+  webhookSecret: String
+  "When set, the auto-deploy webhook has been registered on the GitHub repo (RFC3339)."
+  webhookInstalledAt: String
+}
+
+type GitHubTokenStatus {
+  configured: Boolean!
+  updatedAt: String
+}
+
+type GitHubRepository {
+  owner: String!
+  name: String!
+  nameWithOwner: String!
+  private: Boolean!
+  defaultBranch: String!
+  url: String!
+  connectedWorkspaceID: ID
+  connectedWorkspaceName: String
+}
+
+type GitHubBranch {
+  name: String!
+  commit: String!
+}
+
+type WorkspaceFile {
+  path: String!
+  sizeBytes: Int!
+  size: String!
+  sha256: String!
+  updatedAt: String!
+}
+
+type WorkspaceFileContent {
+  file: WorkspaceFile!
+  text: String!
+  offset: Int!
+  limit: Int!
+  totalBytes: Int!
+  truncated: Boolean!
+  nextOffset: Int
+}
+
+type WorkspaceEnvVar {
+  name: String!
+  value: String
+  secret: Boolean!
+  "Canonical app alias for an app-scoped desired env view; null for workspace defaults."
+  alias: String
+  "True when the app currently follows the workspace default for this name."
+  inherited: Boolean!
+  "True when REMOVE explicitly blocks this name for the app, including integration enrichment."
+  masked: Boolean!
+  updatedAt: String!
+}
+
+"One app alias's configured override set and its share of the workspace-wide env budget."
+type AppEnvScope {
+  alias: String!
+  "App-scoped non-secret overrides."
+  overrides: Int!
+  "App-scoped encrypted secrets. Values are never exposed."
+  secrets: Int!
+  "Explicit REMOVE masks."
+  masks: Int!
+  "Bytes this scope charges against the workspace env size limit."
+  bytes: Int!
+  """
+  ACTIVE — a deployment carries this alias, or a git source redeploys it.
+  PENDING — the alias has never been deployed; this is config staged for an app
+  that has not shipped yet, which is the normal order, so it is NOT junk.
+  ORPHANED — the alias was deployed once and no longer is: the only status
+  that is safe to clear without asking. Every status consumes the shared budget.
+  """
+  status: String!
+  "Newest timestamp across the scope's entries."
+  updatedAt: String!
+}
+
+type Deployment {
+  id: ID!
+  workspaceID: ID!
+  kind: DeploymentKind!
+  "SERVICE runtime (BUN or GO); null for STATIC."
+  runtime: ServiceRuntime
+  alias: String
+  serviceMode: ServiceMode!
+  healthPath: String
+  cronSchedule: String
+  cronPath: String
+  url: String!
+  "Immutable by-id URL (/d/<id>/), stable across alias repoints. Safe to hit before promoting — use it to verify a deploy before it owns the public alias."
+  previewUrl: String!
+  "Ready-to-run SSH command for a BOX (e.g. \"ssh myboxs@ssh.unfazed.dev\"). Null for other kinds and when the gateway is not configured."
+  sshCommand: String
+  "Whether this deployment currently holds its alias (serves the public alias URL)."
+  aliasHeld: Boolean!
+  "Opaque alias-generation token. For rollback, pass the current holder's value as expectedCurrentAliasRevision together with its id; do not interpret it."
+  aliasRevision: String!
+  status: DeploymentStatus!
+  error: String
+  filesCount: Int!
+  sizeBytes: Int!
+  size: String!
+  spaMode: Boolean!
+  gitRepo: String
+  gitCommit: String
+  createdAt: String!
+  """
+  The runtime target serving this exact current deployment: an enrolled worker
+  or the control plane. Null for historical releases and residual legacy
+  placements, which must be migrated rather than presented as normal workers.
+  """
+  worker: DeploymentWorker
+}
+
+"The authoritative runtime target assigned to a current deployment."
+type DeploymentWorker {
+  id: String!
+  "Stable human-readable worker name."
+  name: String!
+  "Region advertised by the worker; null when the assignment has no durable region metadata."
+  region: String
+}
+
+type DeploymentEvent {
+  id: ID!
+  deploymentID: ID!
+  type: DeploymentEventType!
+  rawType: String!
+  severity: DeploymentEventSeverity!
+  message: String!
+  vmID: String
+  metadata: JSON
+  createdAt: String!
+}
+
+type ServiceRuntimeStatus {
+  deploymentID: ID!
+  alias: String
+  serviceMode: ServiceMode!
+  running: Boolean!
+  health: String!
+  vmID: String
+  inFlight: Int!
+  alwaysOn: Boolean!
+  "The VM's RAM ceiling in MiB; guest processes exceeding it are OOM-killed."
+  memSizeMiB: Int!
+  startedAt: String
+  lastUsedAt: String
+  lastStoppedAt: String
+  restartCount: Int!
+  lastError: String
+}
+
+type ServiceRuntimeLogs {
+  deploymentID: ID!
+  stdout: String!
+  stderr: String!
+  truncated: Boolean!
+  stdoutBytes: Int!
+  stderrBytes: Int!
+  tailBytes: Int!
+}
+
+type AppStateValue {
+  found: Boolean!
+  value: String
+  encoding: String
+}
+
+type AppStateKeys {
+  keys: [String!]!
+  count: Int!
+}
+
+type DeleteResultPayload {
+  ok: Boolean!
+}
+
+"An available integration type (e.g. postgres, redis). Managed integrations need no connection; BYO ones declare the control or backend fields they connect with."
+type IntegrationKind {
+  available: Boolean!
+  kind: String!
+  label: String!
+  iconURL: String
+  # who supplies the backend: "platform" (unfazed runs it) or "user" (BYO)
+  provenance: String!
+  # how the owner connects: "none" (no connection), "fields" (a form), "link" (an auth flow)
+  connectMethod: String!
+  fields: [IntegrationField!]!
+  manifestVersion: Int!
+  description: String!
+  capabilities: [String!]!
+  policies: [IntegrationCapabilityPolicy!]!
+  supportedModes: [String!]!
+  "Safe isolation mode selected when bindIntegration omits mode; null for providers without app runtime."
+  defaultMode: String
+  runtime: IntegrationRuntime!
+  surfaces: [IntegrationSurface!]!
+}
+type IntegrationSurface {
+  id: String!
+  spec: JSON!
+}
+type IntegrationCapabilityPolicy {
+  capability: String!
+  allowedScopes: [String!]!
+  defaultActivation: String!
+  replacesLegacyFeed: Boolean!
+}
+type IntegrationRuntime {
+	revision: String!
+	env: [IntegrationRuntimeEnv!]!
+  usage: String!
+}
+type IntegrationRuntimeEnv {
+  name: String!
+  description: String!
+  secret: Boolean!
+}
+type IntegrationField {
+  name: String!
+  label: String!
+  secret: Boolean!
+  required: Boolean!
+}
+"A connected backend or provisioner (the owner's BYO instance). Only non-secret fields are returned; secrets are sealed and never exposed or injected unless the provider explicitly declares passthrough mode."
+type IntegrationConnection {
+  id: ID!
+  kind: String!
+  name: String!
+  "The owning identity; members see it on granted connections to know whose credentials they are borrowing."
+  owner: String!
+  fields: [IntegrationFieldValue!]!
+  configuredFields: [String!]!
+  validationStatus: String!
+  validatedAt: String
+  "Shared projects this connection is currently granted into (owner's own view; empty for borrowed projections)."
+  grantedProjectIDs: [ID!]!
+  createdAt: String!
+  updatedAt: String!
+}
+type IntegrationFieldValue {
+  name: String!
+  value: String!
+}
+"A backend bound to ONE app (by workspace + alias). Scoped bindings own a durable per-app resource and credential; their control connection is never returned."
+type IntegrationBinding {
+  id: ID!
+  kind: String!
+  connectionID: ID
+  workspaceID: ID!
+  alias: String!
+  mode: String
+  "What the binding carries: null/empty = runtime env or events (the legacy default), \"publish\" = external static hosting."
+  capability: String
+  "The published site's public URL (publish bindings only)."
+  siteUrl: String
+  "The user-chosen custom hostname attached to the published site, when one is."
+  siteDomain: String
+  "Durable lifecycle state: provisioning, active, detached, or revoked (the connection grant was withdrawn — the next deploy refuses until the binding is removed or replaced). Legacy rows project as active."
+  status: String!
+  "Set when the binding rides a GRANTED connection: the lender's identity. The lender can always see and sever such bindings."
+  connectionOwner: String
+}
+type IntegrationConnectionPayload {
+  connection: IntegrationConnection!
+}
+type IntegrationBindingPayload {
+  binding: IntegrationBinding!
+  "One-time command (curl) that prints THIS binding's freshly minted credentials as .env lines, exactly once. Present only in the bind response for credential-carrying bindings; it can never be re-issued — only its hash is stored."
+  revealCommand: String
+  "RFC3339 time the unused reveal stops working."
+  revealExpiresAt: String
+}
+"Account-level non-secret event routing. Credential/runtime grants never use this type."
+type IntegrationSubscription {
+  id: ID!
+  kind: String!
+  connectionID: ID
+  capability: String!
+  scope: String!
+  enabled: Boolean!
+  createdAt: String!
+  updatedAt: String!
+}
+input SendFeedbackInput {
+  message: String!
+  "Optional name of the screen/operation where the friction occurred."
+  context: String
+}
+type SendFeedbackPayload {
+  id: ID!
+  createdAt: String!
+}
+input ConnectionGrantInput {
+  connectionID: ID!
+  projectID: ID!
+}
+input SetIntegrationSubscriptionInput {
+  id: ID!
+  enabled: Boolean!
+}
+"Where one effective capability is configured for this app. Values and credentials are never exposed."
+type EffectiveIntegrationSource {
+  scope: String!
+  id: ID
+  inherited: Boolean!
+}
+type EffectiveIntegrationCapability {
+  name: String!
+  source: EffectiveIntegrationSource!
+  configured: Boolean!
+  requiresRedeploy: Boolean!
+  applied: Boolean!
+  appliedDeploymentID: ID
+  appliedEnvNames: [String!]!
+  shadowedEnvNames: [String!]!
+  "The published site's public URL (publish capability only), present from bind time."
+  siteUrl: String
+}
+"Secret-free integration configuration that will apply to this app's next deploy or event."
+type EffectiveIntegration {
+  kind: String!
+  manifest: IntegrationKind!
+  connection: IntegrationConnection
+  capabilities: [EffectiveIntegrationCapability!]!
+}
+type IntegrationLinkPayload {
+  # URL to send the owner to in order to authorize a link integration (e.g. a
+  # Telegram deeplink). The connection is completed by the provider's webhook.
+  url: String!
+}
+input IntegrationFieldValueInput {
+  name: String!
+  value: String!
+}
+input ConnectIntegrationInput {
+  kind: String!
+  name: String!
+  fields: [IntegrationFieldValueInput!]!
+}
+input BindIntegrationInput {
+  kind: String!
+  connectionID: ID
+  workspaceID: ID!
+  alias: String!
+  "Optional provider-supported isolation mode. Omit to use the provider's safe default (scoped for Postgres)."
+  mode: String
+}
+input IntegrationIDInput {
+  id: ID!
+}
+input PublishDomainInput {
+  bindingID: ID!
+  hostname: String!
+}
+type PublishDomainProbe {
+  supported: Boolean!
+  reason: String
+}
+
+type FunctionPage {
+  items: [Function!]!
+  total: Int!
+  limit: Int!
+  offset: Int!
+  hasMore: Boolean!
+  nextOffset: Int
+}
+
+type WorkspacePage {
+  items: [Workspace!]!
+  total: Int!
+  limit: Int!
+  offset: Int!
+  hasMore: Boolean!
+  nextOffset: Int
+}
+
+type WorkspaceFilePage {
+  items: [WorkspaceFile!]!
+  total: Int!
+  limit: Int!
+  offset: Int!
+  hasMore: Boolean!
+  nextOffset: Int
+}
+
+type WorkspaceEnvPage {
+  items: [WorkspaceEnvVar!]!
+  total: Int!
+  limit: Int!
+  offset: Int!
+  hasMore: Boolean!
+  nextOffset: Int
+  format: String!
+}
+
+type DeploymentPage {
+  items: [Deployment!]!
+  total: Int!
+  limit: Int!
+  offset: Int!
+  hasMore: Boolean!
+  nextOffset: Int
+}
+
+type DeploymentEventPage {
+  items: [DeploymentEvent!]!
+  total: Int!
+  limit: Int!
+  offset: Int!
+  hasMore: Boolean!
+  nextOffset: Int
+  format: String!
+}
+
+type Invocation {
+  id: ID!
+  functionID: ID!
+  ok: Boolean!
+  result: JSON
+  stdout: String!
+  stderr: String!
+  error: String
+  exitCode: Int!
+  durationMs: Int!
+  vmID: String
+}
+
+enum CurrentActorKind {
+  "The operator of this Unfazed instance, authenticated with the owner token. Full access, no free-tier limits."
+  OWNER
+  "An automated caller using a self-registered bearer token. Subject to free-tier usage/resource limits; a user can claim it to link it to their account."
+  AGENT
+  "A human signed in via GitHub OAuth, who manages their linked agents and apps."
+  USER
+}
+
+type CurrentActorUsage {
+  month: String!
+  requests: Int!
+  limit: Int!
+}
+
+type CurrentActorResources {
+  workspaces: Int!
+  workspaceLimit: Int!
+  services: Int!
+  serviceLimit: Int!
+}
+
+type CurrentActorUser {
+  kind: CurrentActorKind!
+  userID: String!
+  name: String!
+}
+
+type CurrentActorAgent {
+  agentID: String!
+  name: String!
+  claimed: Boolean!
+  claimedBy: String
+  claimedAt: String
+  "Deployments owned by this linked agent. Resolved lazily — only fetched when selected."
+  deployments: [Deployment!]!
+}
+
+type CurrentActor {
+  kind: CurrentActorKind!
+  userID: String!
+  name: String!
+  clientID: String
+  agentID: String
+  agentName: String
+  claimed: Boolean!
+  claimedBy: String
+  scopes: [String!]!
+  resource: String
+  expiresAt: String
+  usage: CurrentActorUsage
+  resources: CurrentActorResources
+  user: CurrentActorUser
+  agent: CurrentActorAgent
+  linkedAgents: [CurrentActorAgent!]!
+}
+
+type Query {
+  whoami: CurrentActor!
+  functions: [Function!]!
+  functionsPage(input: PageInput): FunctionPage!
+  function(id: ID!): Function
+  "Sources visible to the current account: directly owned plus those of linked claimed agents for a user; own for an agent; all for the operator. The same scope as deployments, so an agent's apps can be grouped into the caller's projects."
+  workspaces: [Workspace!]!
+  "Paginated sources visible to the current account, with the same ownership scope as workspaces."
+  workspacesPage(input: PageInput): WorkspacePage!
+  workspace(id: ID!): Workspace
+  "The signed-in owner's projects (dashboard grouping), oldest first."
+  projects: [Project!]!
+  "Teams the caller belongs to (owner or member), oldest first."
+  myTeams: [Team!]!
+  "Pending team invites addressed to the caller."
+  myTeamInvites: [TeamInviteForMe!]!
+  "The signed-in owner's BYO custom domains, oldest first."
+  customDomains: [CustomDomain!]!
+  "The signed-in account's SSH public keys — the keys that may open its boxes."
+  sshKeys: [SSHKey!]!
+  "Integration types available to connect (postgres, redis, …)."
+  availableIntegrations: [IntegrationKind!]!
+  "The signed-in owner's connected backends."
+  integrationConnections: [IntegrationConnection!]!
+  "Value-free projections of connections granted into a shared project the caller participates in — the bind picker's third section."
+  projectSharedConnections(projectID: ID!): [IntegrationConnection!]!
+  "The signed-in owner's app bindings (which app uses which backend)."
+  integrationBindings: [IntegrationBinding!]!
+  "Account-level event subscriptions, including disabled state."
+  integrationSubscriptions: [IntegrationSubscription!]!
+  "Secret-free configuration effective for this app's next deploy or lifecycle event."
+  effectiveIntegrations(workspaceID: ID!, alias: String!): [EffectiveIntegration!]!
+  "Whether the publish binding's connection can attach custom domains right now (a live probe against the provider). reason is set when it cannot — e.g. the API token lacks zone permissions."
+  publishDomainProbe(bindingID: ID!): PublishDomainProbe!
+  workspaceFiles(workspaceID: ID!): [WorkspaceFile!]!
+  workspaceFilesPage(input: ListWorkspaceFilesInput!): WorkspaceFilePage!
+  readWorkspaceFile(input: ReadWorkspaceFileInput!): WorkspaceFileContent
+  workspaceEnv(workspaceID: ID!): [WorkspaceEnvVar!]!
+  workspaceEnvPage(input: ListWorkspaceEnvInput!): WorkspaceEnvPage!
+  "Configured desired env for one monorepo app alias: overrides, inherited workspace defaults, and explicit REMOVE masks. Integration bindings and runtime env names are discovered separately; credential values are never exposed."
+  appEnv(workspaceID: ID!, alias: String!): [WorkspaceEnvVar!]!
+  "Paginated configured desired env for one monorepo app alias. Integration bindings and runtime env names are discovered separately; credential values are never exposed."
+  appEnvPage(input: ListAppEnvInput!): WorkspaceEnvPage!
+  "Every configured app scope in the workspace with what it costs against the shared env budget. App scopes are otherwise reachable only by exact alias, so this is how an orphaned one — a scope no deployment claims any more — becomes visible."
+  appEnvScopes(workspaceID: ID!): [AppEnvScope!]!
+  "Deployments visible to the current account: directly owned plus linked claimed-agent deployments for a user; own deployments for an agent; all deployments for the operator."
+  deployments: [Deployment!]!
+  "Paginated deployments visible to the current account, with the same ownership scope as deployments."
+  deploymentsPage(input: ListDeploymentsInput): DeploymentPage!
+  "Deployments owned by one of your linked (claimed) agents; the operator may query any agent."
+  agentDeployments(agentID: ID!): [Deployment!]!
+  deployment(id: ID!): Deployment
+  "The alias holder visible to the current account. A human who claimed the holder's agent may use its id and aliasRevision as the compare-and-swap tuple for adoptDeploymentAlias."
+  deploymentByAlias(alias: String!): Deployment
+  "An alias's terminal history, newest first: the current holder, retained READY snapshots, and FAILED promotion attempts. Only READY non-current entries are rollback targets."
+  deploymentReleases(alias: String!): [Deployment!]!
+  deploymentEvents(deploymentID: ID!, limit: Int): [DeploymentEvent!]!
+  deploymentEventsPage(input: ListDeploymentEventsInput!): DeploymentEventPage!
+  serviceStatus(deploymentID: ID!): ServiceRuntimeStatus!
+  serviceLogs(deploymentID: ID!, tailBytes: Int): ServiceRuntimeLogs!
+  appState(alias: String!, key: String!): AppStateValue!
+  appStateKeys(alias: String!): AppStateKeys!
+  githubToken: GitHubTokenStatus!
+  githubRepositories: [GitHubRepository!]!
+  githubBranches(repo: String!): [GitHubBranch!]!
+}
+
+type Mutation {
+  registerFunction(input: RegisterFunctionInput!): Function!
+  invokeFunction(input: InvokeFunctionInput!): Invocation!
+  createWorkspace(input: CreateWorkspaceInput!): CreateWorkspacePayload!
+  "Rename an app (its workspace). Does not change its alias or public URL."
+  renameWorkspace(input: RenameWorkspaceInput!): Workspace!
+  "Create an empty project to group apps under (dashboard only)."
+  createProject(input: CreateProjectInput!): ProjectPayload!
+  "Rename a project."
+  renameProject(input: RenameProjectInput!): ProjectPayload!
+  "Delete a project; its apps are detached (ungrouped), never deleted."
+  deleteProject(input: DeleteProjectInput!): DeleteResultPayload!
+  "Group a workspace under a project (same owner), or ungroup it when projectId is null."
+  assignWorkspaceToProject(input: AssignWorkspaceToProjectInput!): Workspace!
+  "Create a team owned by the caller (one owned team per user)."
+  createTeam(input: CreateTeamInput!): TeamPayload!
+  "Rename a team (team owner only)."
+  renameTeam(input: RenameTeamInput!): TeamPayload!
+  "Delete a team; resources are untouched, members just stop seeing each other's (team owner only)."
+  deleteTeam(input: TeamIDInput!): DeleteResultPayload!
+  "Invite a github login to the team (team owner only)."
+  inviteTeamMember(input: TeamInviteInput!): TeamPayload!
+  "Withdraw a pending invite (team owner only)."
+  cancelTeamInvite(input: TeamMemberInput!): TeamPayload!
+  "Accept the caller's pending invite; joining is two-way visibility."
+  acceptTeamInvite(input: TeamIDInput!): TeamPayload!
+  "Decline the caller's pending invite."
+  declineTeamInvite(input: TeamIDInput!): DeleteResultPayload!
+  "Remove a member (team owner only; the owner deletes the team instead)."
+  removeTeamMember(input: TeamMemberInput!): TeamPayload!
+  "Leave a team (members only; the owner deletes the team instead)."
+  leaveTeam(input: TeamIDInput!): DeleteResultPayload!
+  "Share one of the caller's projects with a team they belong to."
+  shareProjectWithTeam(input: TeamProjectInput!): TeamPayload!
+  "Withdraw a share (project owner or team owner)."
+  unshareProjectFromTeam(input: TeamProjectInput!): TeamPayload!
+  "Connect a BYO backend or provisioner (Postgres/Redis/…); provider-declared secret fields are sealed and never returned."
+  connectIntegration(input: ConnectIntegrationInput!): IntegrationConnectionPayload!
+  "Start the link flow for a link integration (e.g. Telegram); returns a URL to open."
+  startIntegrationLink(kind: String!): IntegrationLinkPayload!
+  "Delete a connected backend by id. Active bindings must be unbound first; detached bindings retain it until rollback/provider cleanup completes."
+  deleteIntegrationConnection(input: IntegrationIDInput!): DeleteResultPayload!
+  "Bind a backend to ONE app. Scoped providers first create a distinct per-app resource and credential; the app receives only that credential on its next deploy."
+  bindIntegration(input: BindIntegrationInput!): IntegrationBindingPayload!
+  "Attach a custom hostname (a zone already in the connected account) to a publish binding's site. Replaces the previously attached hostname, if any."
+  setPublishDomain(input: PublishDomainInput!): IntegrationBindingPayload!
+  "Detach the publish binding's custom hostname. The site stays reachable at its provider URL."
+  removePublishDomain(input: IntegrationIDInput!): IntegrationBindingPayload!
+  """
+  Share the RIGHT TO BIND a connection into a shared project. The values stay
+  in the owner's account, but an app owner who binds it can effectively read
+  them at runtime (env cannot be hidden from the code that receives it) —
+  revoking a grant is therefore NOT rotation.
+  """
+  grantConnectionToProject(input: ConnectionGrantInput!): IntegrationConnectionPayload!
+  """
+  Report a platform friction point or bug to the operator — from the surface
+  where it happened. Free-form; one short message with what you expected and
+  what happened instead is enough.
+  """
+  sendFeedback(input: SendFeedbackInput!): SendFeedbackPayload!
+  "Withdraw a grant. Dependent bindings by other accounts flip to revoked and their next deploy fails loudly; running releases keep the env they booted with."
+  revokeConnectionGrant(input: ConnectionGrantInput!): IntegrationConnectionPayload!
+  "Detach a binding by id. New deploys omit it; rollback credentials are retained until no immutable deployment references the binding, then revoked."
+  unbindIntegration(input: IntegrationIDInput!): DeleteResultPayload!
+  "Enable or disable an account-level integration event subscription."
+  setIntegrationSubscription(input: SetIntegrationSubscriptionInput!): IntegrationSubscription!
+  "Register a public key for the signed-in account so it can SSH into that account's boxes. Adding the same key twice returns the existing record."
+  addSSHKey(input: AddSSHKeyInput!): SSHKey!
+  "Remove one of the account's SSH public keys. Takes effect on the next connection; live sessions are unaffected."
+  removeSSHKey(input: RemoveSSHKeyInput!): DeleteResultPayload!
+  "Attach a BYO custom domain to an app's alias (point its DNS at the edge first)."
+  addCustomDomain(input: AddCustomDomainInput!): CustomDomain!
+  "Detach a custom domain; the app keeps serving on its alias/URL."
+  removeCustomDomain(input: RemoveCustomDomainInput!): DeleteResultPayload!
+  writeWorkspaceTextFile(input: WriteWorkspaceTextFileInput!): WorkspaceFilePayload!
+  writeWorkspaceBase64File(input: WriteWorkspaceBase64FileInput!): WorkspaceFilePayload!
+  uploadWorkspaceFile(input: UploadWorkspaceFileInput!): WorkspaceFilePayload!
+  deleteWorkspaceFile(input: DeleteWorkspaceFileInput!): DeleteWorkspaceFilePayload!
+  setWorkspaceEnv(input: SetWorkspaceEnvInput!): SetWorkspaceEnvPayload!
+  setWorkspaceSecret(input: SetWorkspaceSecretInput!): SetWorkspaceEnvPayload!
+  deleteWorkspaceEnv(input: DeleteWorkspaceEnvInput!): DeleteWorkspaceEnvPayload!
+  "Override one non-secret env var for a single app alias."
+  setAppEnv(input: SetAppEnvInput!): SetWorkspaceEnvPayload!
+  "Override one encrypted secret for a single app alias. The value is never returned."
+  setAppSecret(input: SetAppSecretInput!): SetWorkspaceEnvPayload!
+  "REMOVE an env name for one app, blocking the workspace default and integration enrichment."
+  removeAppEnv(input: RemoveAppEnvInput!): DeleteWorkspaceEnvPayload!
+  "Clear an app override or REMOVE mask so the app follows workspace/integration defaults again."
+  inheritAppEnv(input: InheritAppEnvInput!): DeleteWorkspaceEnvPayload!
+  "Drop an app's entire scope — every override, secret, and REMOVE mask — in one call, so it follows workspace/integration defaults again. The bulk form of inheritAppEnv, and the only way a scope is ever removed: deleting a deployment keeps its config, because app secrets cannot be read back and dropping a REMOVE mask would expose a workspace default the app denied."
+  clearAppEnv(input: ClearAppEnvInput!): ClearAppEnvPayload!
+  createDeployment(input: CreateDeploymentInput!): CreateDeploymentPayload!
+  "Build the directly owned target workspace, then atomically transfer an alias held by one of the caller's claimed agents after the replacement is READY. The current holder remains live while the replacement builds. Pass the id and aliasRevision observed through deploymentByAlias; the operation fails if either changed, if the alias has a custom domain or stateful placement, or if it would replace a SERVICE with STATIC."
+  adoptDeploymentAlias(input: AdoptDeploymentAliasInput!): CreateDeploymentPayload!
+  "Deploy a workspace's CURRENT files, detecting the kind from them (a root server.ts/index.html or an unfazed.json). The recovery path after a failed import: add/fix unfazed.json (or an entry), then deploy — no git re-fetch. Errors with what to add if the files still aren't deployable."
+  deployWorkspace(input: DeployWorkspaceInput!): CreateDeploymentPayload!
+  "Import and deploy a GitHub repo into a new workspace. Kind/runtime are detected from the repo root (server.ts/go.mod+main.go -> SERVICE, index.html -> STATIC) unless a root unfazed.json overrides it. For a monorepo, a root unfazed.json `apps` array deploys SEVERAL apps from one push — each {alias, rootDir} builds that subdirectory as its own app (apps[] is repo config, not an input here; the same applies to syncRepo and webhook pushes). Returns immediately with an IMPORTING status; the fetch+build runs in the background."
+  importRepo(input: ImportRepoInput!): ImportRepoPayload!
+  "Link a GitHub repo to an EXISTING workspace (one with no source yet) and import it. The workspace keeps its id, env, and secrets. If unfazed.json apps[] omits the supplied/stored current alias, that alias, its current deployment, and its App State are retired."
+  connectRepo(input: ConnectRepoInput!): ImportRepoPayload!
+  syncRepo(input: SyncRepoInput!): ImportRepoPayload!
+  unlinkRepo(input: UnlinkRepoInput!): DeleteResultPayload!
+  installRepoWebhook(input: InstallRepoWebhookInput!): ImportRepoPayload!
+  setRepoDeployAlias(input: SetRepoDeployAliasInput!): ImportRepoPayload!
+  setGitHubToken(input: SetGitHubTokenInput!): GitHubTokenStatus!
+  deleteGitHubToken: GitHubTokenStatus!
+  restartService(input: ServiceControlInput!): ServiceRuntimeStatus!
+  stopService(input: ServiceControlInput!): ServiceRuntimeStatus!
+  "Permanently delete a deployment and its files snapshot, stopping a running service VM first. Alias-keyed app state is freed once no other deployment uses the alias; the alias's app-scoped env and secrets are reclaimed on that condition plus two more — the alias really was deployed once, and no git source redeploys it — so deleting a failed first build keeps the env staged for the retry. That reclaim is not reversible: secret values are never returned by the API."
+  deleteDeployment(input: DeleteDeploymentInput!): DeleteResultPayload!
+  "Roll an alias back to a PRIOR release: atomically repoint it to the given deployment and bring that snapshot back (always_on restarts warm; on_demand cold-starts on the next request). Also reverts to that release's env/secrets snapshot. Pass the id and opaque aliasRevision of the aliasHeld release you observed; the rollback fails if either changed since deploymentReleases."
+  rollbackDeployment(input: RollbackDeploymentInput!): Deployment!
+  deleteWorkspace(input: DeleteWorkspaceInput!): DeleteResultPayload!
+  setAppState(input: SetAppStateInput!): AppStateValue!
+  deleteAppState(input: DeleteAppStateInput!): DeleteResultPayload!
+  "Rename a linked (claimed) agent. Allowed for the agent's claimer or the operator."
+  renameAgent(input: RenameAgentInput!): CurrentActorAgent!
+  "Delete a linked (claimed) agent: revoke its token AND delete every workspace and deployment it owns (stopping service VMs). Irreversible."
+  deleteAgent(input: DeleteAgentInput!): DeleteResultPayload!
+  "Issue a fresh access token for a linked (claimed) agent, keeping its identity so it can still redeploy the aliases it owns. Self-registration cannot do this: it always mints a NEW agent, and the platform refuses to let a different owner near an existing alias. Every previous token of the agent stops working immediately, so write the returned value wherever the agent reads it. The token is returned once and is never retrievable again. Allowed for the agent's claimer or the operator."
+  rotateAgentToken(input: RotateAgentTokenInput!): AgentTokenPayload!
+  "Issue a one-time code to connect the caller's Telegram to deploy notifications. Returns a t.me deep link to open the bot with the code prefilled; the code expires and is single-use."
+  createTelegramLinkCode: TelegramLinkPayload!
+}
+
+type TelegramLinkPayload {
+  "Open this to start the bot with the code prefilled (t.me/<bot>?start=<code>)."
+  deepLink: String!
+  "The raw code, in case the deep link can't be used (send the bot: /start <code>)."
+  code: String!
+  "RFC3339 time the code stops working."
+  expiresAt: String!
+  "The bot's @username (no @)."
+  botUsername: String!
+}
+
+input RenameAgentInput {
+  agentID: ID!
+  name: String!
+}
+
+input DeleteAgentInput {
+  agentID: ID!
+}
+
+input RotateAgentTokenInput {
+  agentID: ID!
+}
+
+"A newly issued agent credential. Shown once: only its hash is stored."
+type AgentTokenPayload {
+  "The agent this token authenticates as — unchanged by rotation."
+  agentID: ID!
+  "The bearer token. Copy it now; it cannot be read again."
+  accessToken: String!
+  tokenType: String!
+  scopes: [String!]!
+  "RFC3339 time the token stops working."
+  expiresAt: String!
+}
+
+input RegisterFunctionInput {
+  name: String!
+  file: File!
+  packageJSON: File
+  bunLock: File
+}
+
+input InvokeFunctionInput {
+  functionID: ID!
+  payload: JSON
+}
+
+input PageInput {
+  limit: Int
+  offset: Int
+  order: String
+}
+
+input CreateWorkspaceInput {
+  name: String!
+}
+
+input RenameWorkspaceInput {
+  workspaceID: ID!
+  name: String!
+}
+
+type CreateWorkspacePayload {
+  workspace: Workspace!
+}
+
+input WriteWorkspaceTextFileInput {
+  workspaceID: ID!
+  path: String!
+  text: String!
+}
+
+input WriteWorkspaceBase64FileInput {
+  workspaceID: ID!
+  path: String!
+  contentBase64: String!
+}
+
+input UploadWorkspaceFileInput {
+  workspaceID: ID!
+  path: String!
+  file: File!
+}
+
+type WorkspaceFilePayload {
+  file: WorkspaceFile!
+}
+
+input ReadWorkspaceFileInput {
+  workspaceID: ID!
+  path: String!
+  offset: Int
+  limit: Int
+}
+
+input ListWorkspaceFilesInput {
+  workspaceID: ID!
+  limit: Int
+  offset: Int
+  order: String
+}
+
+input ListWorkspaceEnvInput {
+  workspaceID: ID!
+  limit: Int
+  offset: Int
+  order: String
+  format: String
+}
+
+input ListAppEnvInput {
+  workspaceID: ID!
+  alias: String!
+  limit: Int
+  offset: Int
+  order: String
+  format: String
+}
+
+input DeleteWorkspaceFileInput {
+  workspaceID: ID!
+  path: String!
+}
+
+type DeleteWorkspaceFilePayload {
+  ok: Boolean!
+}
+
+input SetWorkspaceEnvInput {
+  workspaceID: ID!
+  name: String!
+  value: String!
+}
+
+input SetWorkspaceSecretInput {
+  workspaceID: ID!
+  name: String!
+  value: String!
+}
+
+type SetWorkspaceEnvPayload {
+  env: WorkspaceEnvVar!
+}
+
+input DeleteWorkspaceEnvInput {
+  workspaceID: ID!
+  name: String!
+}
+
+input SetAppEnvInput {
+  workspaceID: ID!
+  alias: String!
+  name: String!
+  value: String!
+}
+
+input SetAppSecretInput {
+  workspaceID: ID!
+  alias: String!
+  name: String!
+  value: String!
+}
+
+input RemoveAppEnvInput {
+  workspaceID: ID!
+  alias: String!
+  name: String!
+}
+
+input InheritAppEnvInput {
+  workspaceID: ID!
+  alias: String!
+  name: String!
+}
+
+input ClearAppEnvInput {
+  workspaceID: ID!
+  alias: String!
+}
+
+type ClearAppEnvPayload {
+  "True when the call removed something. Clearing an already-clear scope returns false with removed 0 and is not an error."
+  ok: Boolean!
+  "How many overrides, secrets, and REMOVE masks were dropped."
+  removed: Int!
+}
+
+type DeleteWorkspaceEnvPayload {
+  ok: Boolean!
+}
+
+"""
+Creates a deployment from the workspace's current files. The build is driven by
+an optional root unfazed.json: STATIC serves the files as-is unless unfazed.json
+sets build (a command run in the build VM) + output (publish dir, default "dist"
+when build is set; output with no build republishes a committed dir like dist/ as
+is); SERVICE bundles server.ts by default, or the entry set in unfazed.json.
+install defaults to "bun install" (--frozen-lockfile when a bun lockfile exists).
+"""
+input CreateDeploymentInput {
+  workspaceID: ID!
+  "STATIC (serve files) or SERVICE (run an HTTP server). Classify it yourself: SERVICE if the workspace has server.ts, a go.mod+main.go, or an unfazed.json entry, else STATIC."
+  kind: DeploymentKind!
+  "SERVICE runtime. Omit to auto-detect (a go.mod+main.go is GO, otherwise BUN). Ignored for STATIC."
+  runtime: ServiceRuntime
+  alias: String
+  "STATIC only: when true, missing paths serve index.html (single-page apps). Ignored for SERVICE."
+  spaMode: Boolean
+  "SERVICE only. Omit for ON_DEMAND (the default — sleeps and cold-starts on first request, right for most services). Set ALWAYS_ON only to keep the VM warm."
+  serviceMode: ServiceMode
+  healthPath: String
+  """
+  Standard 5-field cron spec (minute hour day-of-month month day-of-week). When
+  set, the platform wakes the SERVICE on each tick with a POST to cronPath
+  (default /cron) carrying header X-Unfz-Trigger: cron and a signed
+  X-Unfz-Cron-Token equal to the service's UNFZ_STATE_TOKEN.
+  """
+  cronSchedule: String
+  "Absolute HTTP path the cron tick POSTs to; defaults to /cron when cronSchedule is set."
+  cronPath: String
+  "BOX only: optional VM size. Omit for the platform defaults."
+  boxResources: BoxResourcesInput
+}
+
+"A box's requested VM size. Omitted fields use the platform default."
+input BoxResourcesInput {
+  "RAM in MiB (default 2048, min 512, max 16384)."
+  memMiB: Int
+  "vCPU count (default 2, max 8)."
+  vcpus: Int
+  "Persistent disk in GiB (default 8, max 64). Applies only when the disk is first created; an existing disk keeps its size."
+  diskGiB: Int
+}
+
+input AdoptDeploymentAliasInput {
+  alias: String!
+  "The caller's directly owned workspace whose current files will become the replacement."
+  targetWorkspaceID: ID!
+  "The id returned by deploymentByAlias for the current holder. Required compare-and-swap guard."
+  expectedCurrentDeploymentID: ID!
+  "The opaque aliasRevision returned with that holder. Required compare-and-swap guard against same-id ABA."
+  expectedCurrentAliasRevision: String!
+}
+
+input DeployWorkspaceInput {
+  workspaceID: ID!
+  "Optional public alias; defaults to the workspace's git deploy alias when it was imported."
+  alias: String
+  "SERVICE only; defaults to the git source's mode, otherwise ON_DEMAND."
+  serviceMode: ServiceMode
+  "STATIC only; overrides the detected SPA fallback."
+  spaMode: Boolean
+}
+
+type CreateDeploymentPayload {
+  deployment: Deployment!
+}
+
+input ImportRepoInput {
+  repo: String!
+  ref: String
+  alias: String
+  spaMode: Boolean
+  serviceMode: ServiceMode
+  autoDeploy: Boolean
+  force: Boolean
+}
+
+input ConnectRepoInput {
+  workspaceID: ID!
+  repo: String!
+  ref: String
+  alias: String
+  spaMode: Boolean
+  serviceMode: ServiceMode
+  autoDeploy: Boolean
+}
+
+input SyncRepoInput {
+  workspaceID: ID!
+  force: Boolean
+}
+
+input UnlinkRepoInput {
+  workspaceID: ID!
+}
+
+input InstallRepoWebhookInput {
+  workspaceID: ID!
+}
+
+input SetRepoDeployAliasInput {
+  workspaceID: ID!
+  "The alias future pushes/syncs should deploy to. The deploy-time guard re-checks ownership."
+  alias: String!
+}
+
+input SetGitHubTokenInput {
+  token: String!
+}
+
+type ImportRepoPayload {
+  workspace: Workspace!
+  deployment: Deployment
+  gitSource: GitSource
+  noop: Boolean!
+}
+
+input ListDeploymentsInput {
+  limit: Int
+  offset: Int
+  kind: DeploymentKind
+  alias: String
+  workspaceID: ID
+  order: String
+}
+
+input ListDeploymentEventsInput {
+  deploymentID: ID!
+  limit: Int
+  offset: Int
+  order: String
+  format: String
+}
+
+input ServiceControlInput {
+  deploymentID: ID!
+}
+
+input DeleteDeploymentInput {
+  deploymentID: ID!
+}
+
+input RollbackDeploymentInput {
+  "The prior deployment to restore as the alias's live release. Get candidate ids from deploymentReleases."
+  deploymentID: ID!
+  "The id of the aliasHeld release observed in the same deploymentReleases result. Required compare-and-swap guard."
+  expectedCurrentDeploymentID: ID!
+  "The opaque aliasRevision of that aliasHeld release. Required compare-and-swap guard against same-id ABA."
+  expectedCurrentAliasRevision: String!
+}
+
+input DeleteWorkspaceInput {
+  workspaceID: ID!
+  "Also delete every deployment snapshotted from the workspace (stopping service VMs) instead of refusing while any exist."
+  withDeployments: Boolean
+}
+
+input SetAppStateInput {
+  alias: String!
+  key: String!
+  value: String!
+  encoding: String
+}
+
+input DeleteAppStateInput {
+  alias: String!
+  key: String!
+}