unfazed 0.6.0 → 0.6.1

package/dist/client.js

@@ -1,6 +1,7 @@
+import { LOGIN_COMMAND, openStoredLogin } from "./credentials.js";
 import { UnfazedAuthError, UnfazedConfigError, UnfazedGraphQLError, UnfazedHTTPError, UnfazedTimeoutError, } from "./errors.js";
 /** SDK version, sent as the User-Agent. Keep in sync with package.json. */
-export const VERSION = "0.6.0";
+export const VERSION = "0.6.1";
 /**
  * Default GraphQL endpoint.
  *
@@ -36,7 +37,7 @@ export const ENDPOINT_ENV_VAR = "UNFZ_API_URL";
  * deliberately covers only the agent-facing ones.
  *
  * ```ts
- * const client = new UnfazedClient();               // reads UNFZ_API_TOKEN
+ * const client = new UnfazedClient();     // UNFZ_API_TOKEN, else `npx unfazed login`
  * const data = await client.query<{ whoami: { name: string } }, never>(
  *   `query { whoami { name } }`,
  * );
@@ -45,20 +46,13 @@ export const ENDPOINT_ENV_VAR = "UNFZ_API_URL";
 export class UnfazedClient {
     /** Resolved GraphQL endpoint URL. */
     endpoint;
-    #token;
+    /** A fixed bearer token, or the stored login handing out refreshed ones. */
+    #auth;
     #headers;
     #timeoutMs;
     #fetch;
     constructor(options = {}) {
-        const token = options.token ?? readEnv(TOKEN_ENV_VAR);
-        if (!token) {
-            throw new UnfazedAuthError(`unfazed: no API token. Pass { token } or set ${TOKEN_ENV_VAR}. ` +
-                `Get one at ${DEFAULT_BASE_URL}/auth.md`);
-        }
-        this.#token = token.trim();
-        this.endpoint = resolveEndpoint(options);
-        this.#headers = { ...(options.headers ?? {}) };
-        this.#timeoutMs = options.timeoutMs ?? 60_000;
+        const env = options.env ?? processEnv();
         const injected = options.fetch;
         if (injected) {
             this.#fetch = injected;
@@ -71,9 +65,40 @@ export class UnfazedClient {
             this.#fetch = globalFetch.bind(globalThis);
         }
         const ua = options.userAgent ?? `unfazed-sdk/${VERSION}`;
+        const configured = configuredEndpoint(options, env);
+        const token = options.token ?? env[TOKEN_ENV_VAR];
+        if (token?.trim()) {
+            this.#auth = { token: token.trim() };
+            this.endpoint = configured ?? DEFAULT_ENDPOINT;
+        }
+        else {
+            const stored = options.login === false
+                ? {}
+                : openStoredLogin({
+                    env,
+                    ...(configured ? { endpoint: configured } : {}),
+                    fetch: this.#fetch,
+                    // The edge refuses some generic agents; always name ourselves.
+                    userAgent: ua || `unfazed-sdk/${VERSION}`,
+                });
+            if (!stored.login) {
+                throw new UnfazedAuthError(noTokenMessage(configured, stored.other?.endpoint));
+            }
+            this.#auth = { login: stored.login };
+            this.endpoint = stored.login.endpoint;
+        }
+        this.#headers = { ...(options.headers ?? {}) };
+        this.#timeoutMs = options.timeoutMs ?? 60_000;
         if (ua)
             this.#headers["User-Agent"] = ua;
     }
+    /**
+     * Where the bearer token comes from: `"token"` (passed or
+     * `UNFZ_API_TOKEN`) or `"login"` (the stored login of `npx unfazed login`).
+     */
+    get authSource() {
+        return "login" in this.#auth ? "login" : "token";
+    }
     /** Runs a query document. Identical wire behaviour to {@link mutate}. */
     query(document, variables, options) {
         return this.request(document, variables, options);
@@ -94,7 +119,6 @@ export class UnfazedClient {
      */
     async request(document, variables, options = {}) {
         const timeoutMs = options.timeoutMs ?? this.#timeoutMs;
-        const { signal, cleanup, didTimeout } = makeSignal(timeoutMs, options.signal);
         // `document` may be a TypedDocumentString (a String object). JSON.stringify
         // would serialise that fine, but String(...) keeps the wire body a plain
         // primitive regardless of how the caller obtained the document.
@@ -103,27 +127,62 @@ export class UnfazedClient {
             ...(variables === undefined ? {} : { variables }),
             ...(options.operationName ? { operationName: options.operationName } : {}),
         });
+        let token = await this.#token();
+        let { response, text } = await this.#send(body, token, timeoutMs, options.signal);
+        // A stored login's access token can be refused before its recorded
+        // expiry (the clock, a sign-out elsewhere): refresh once and retry. A
+        // fixed token has nothing to refresh.
+        if (response.status === 401 && "login" in this.#auth) {
+            token = await this.#auth.login.refresh(token);
+            ({ response, text } = await this.#send(body, token, timeoutMs, options.signal));
+        }
+        if (!response.ok) {
+            throw new UnfazedHTTPError(response.status, text, this.endpoint);
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(text);
+        }
+        catch {
+            throw new UnfazedHTTPError(response.status, text, this.endpoint);
+        }
+        // A GraphQL 200 can still be a failure, and can be a PARTIAL failure: the
+        // batched writeFiles document resolves each aliased field independently.
+        // Attaching `data` to the error is what lets a caller see which writes
+        // landed before the failing one.
+        if (parsed.errors?.length) {
+            throw new UnfazedGraphQLError(parsed.errors, parsed.data);
+        }
+        if (parsed.data === undefined || parsed.data === null) {
+            throw new UnfazedGraphQLError([{ message: "response contained neither data nor errors" }], undefined);
+        }
+        return parsed.data;
+    }
+    #token() {
+        return "login" in this.#auth ? this.#auth.login.token() : Promise.resolve(this.#auth.token);
+    }
+    async #send(body, token, timeoutMs, external) {
+        const { signal, cleanup, didTimeout } = makeSignal(timeoutMs, external);
         // The deadline covers BOTH phases — headers AND body. A proxy that answers
         // with headers and then stalls the body is a real failure mode, and
         // stopping the clock at the end of `fetch()` would leave `response.text()`
         // hanging forever. `untilAborted` additionally races the signal itself, so
         // an injected transport that ignores `signal` still cannot outlive the
         // timeout.
-        let response;
-        let text;
         try {
-            response = await untilAborted(this.#fetch(this.endpoint, {
+            const response = await untilAborted(this.#fetch(this.endpoint, {
                 method: "POST",
                 headers: {
                     ...this.#headers,
                     "Content-Type": "application/json",
                     Accept: "application/json",
-                    Authorization: `Bearer ${this.#token}`,
+                    Authorization: `Bearer ${token}`,
                 },
                 body,
                 ...(signal ? { signal } : {}),
             }), signal);
-            text = await untilAborted(response.text(), signal);
+            const text = await untilAborted(response.text(), signal);
+            return { response, text };
         }
         catch (cause) {
             if (didTimeout()) {
@@ -137,50 +196,36 @@ export class UnfazedClient {
         finally {
             cleanup();
         }
-        if (!response.ok) {
-            throw new UnfazedHTTPError(response.status, text, this.endpoint);
-        }
-        let parsed;
-        try {
-            parsed = JSON.parse(text);
-        }
-        catch {
-            throw new UnfazedHTTPError(response.status, text, this.endpoint);
-        }
-        // A GraphQL 200 can still be a failure, and can be a PARTIAL failure: the
-        // batched writeFiles document resolves each aliased field independently.
-        // Attaching `data` to the error is what lets a caller see which writes
-        // landed before the failing one.
-        if (parsed.errors?.length) {
-            throw new UnfazedGraphQLError(parsed.errors, parsed.data);
-        }
-        if (parsed.data === undefined || parsed.data === null) {
-            throw new UnfazedGraphQLError([{ message: "response contained neither data nor errors" }], undefined);
-        }
-        return parsed.data;
     }
 }
-function resolveEndpoint(options) {
+/** The endpoint the options or `UNFZ_API_URL` name, or undefined for the default. */
+function configuredEndpoint(options, env) {
     if (options.endpoint)
         return options.endpoint;
     if (options.baseUrl)
         return trimSlash(options.baseUrl) + GRAPHQL_PATH;
-    const env = readEnv(ENDPOINT_ENV_VAR);
+    const fromEnv = env[ENDPOINT_ENV_VAR];
     // UNFZ_API_URL is documented as the full /query URL and is used verbatim.
     // Tolerate a bare origin anyway, since that is the obvious mistake and
     // guessing right costs nothing.
-    if (env) {
-        const trimmed = trimSlash(env);
+    if (fromEnv) {
+        const trimmed = trimSlash(fromEnv);
         return /\/query$|\/graphql$/.test(trimmed) ? trimmed : trimmed + GRAPHQL_PATH;
     }
-    return DEFAULT_ENDPOINT;
+    return undefined;
+}
+function noTokenMessage(endpoint, otherLogin) {
+    if (endpoint && otherLogin) {
+        return (`unfazed: no API token for ${endpoint}: the stored login is for ${otherLogin}. ` +
+            `Run \`${ENDPOINT_ENV_VAR}=${endpoint} ${LOGIN_COMMAND}\`, or pass { token } / set ${TOKEN_ENV_VAR}.`);
+    }
+    return (`unfazed: not signed in. Run \`${LOGIN_COMMAND}\` to sign in with your account, ` +
+        `or pass { token } / set ${TOKEN_ENV_VAR} (an agent token: ${DEFAULT_BASE_URL}/auth.md).`);
 }
-function readEnv(name) {
+function processEnv() {
     // Guarded: the SDK must also work in a browser or worker, where there is no
     // `process` at all.
-    const env = globalThis.process
-        ?.env;
-    return env?.[name] || undefined;
+    return globalThis.process?.env ?? {};
 }
 function trimSlash(u) {
     return u.replace(/\/+$/, "");

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GAEpB,MAAM,aAAa,CAAC;AAErB,2EAA2E;AAC3E,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AAE5D,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAEtD,oDAAoD;AACpD,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAC;AAErC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAE9C,kEAAkE;AAClE,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AA+E/C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,aAAa;IACxB,qCAAqC;IAC5B,QAAQ,CAAS;IAEjB,MAAM,CAAS;IACf,QAAQ,CAAyB;IACjC,UAAU,CAAS;IACnB,MAAM,CAAY;IAE3B,YAAY,UAAyB,EAAE;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,gBAAgB,CACxB,gDAAgD,aAAa,IAAI;gBAC/D,cAAc,gBAAgB,UAAU,CAC3C,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAE3B,IAAI,CAAC,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAEzC,IAAI,CAAC,QAAQ,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;QAE9C,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC;QAC/B,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,GAAI,UAAkC,CAAC,KAAK,CAAC;YAC9D,IAAI,OAAO,WAAW,KAAK,UAAU,EAAE,CAAC;gBACtC,MAAM,IAAI,kBAAkB,CAC1B,iFAAiF,CAClF,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAc,CAAC;QAC1D,CAAC;QAED,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,IAAI,eAAe,OAAO,EAAE,CAAC;QACzD,IAAI,EAAE;YAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC;IAC3C,CAAC;IAED,yEAAyE;IACzE,KAAK,CACH,QAA8C,EAC9C,SAAsB,EACtB,OAAwB;QAExB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IAED;;;OAGG;IACH,MAAM,CACJ,QAA8C,EAC9C,SAAsB,EACtB,OAAwB;QAExB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CACX,QAAyC,EACzC,SAAmB,EACnB,UAA0B,EAAE;QAE5B,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC;QACvD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAE9E,4EAA4E;QAC5E,yEAAyE;QACzE,gEAAgE;QAChE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC;YACvB,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;YACjD,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3E,CAAC,CAAC;QAEH,2EAA2E;QAC3E,oEAAoE;QACpE,2EAA2E;QAC3E,2EAA2E;QAC3E,uEAAuE;QACvE,WAAW;QACX,IAAI,QAAwC,CAAC;QAC7C,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,YAAY,CAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE;gBACzB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,GAAG,IAAI,CAAC,QAAQ;oBAChB,cAAc,EAAE,kBAAkB;oBAClC,MAAM,EAAE,kBAAkB;oBAC1B,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;iBACvC;gBACD,IAAI;gBACJ,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9B,CAAC,EACF,MAAM,CACP,CAAC;YACF,IAAI,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,UAAU,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,SAAS,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnB,MAAM,IAAI,mBAAmB,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,MAA2D,CAAC;QAChE,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnE,CAAC;QAED,0EAA0E;QAC1E,yEAAyE;QACzE,uEAAuE;QACvE,iCAAiC;QACjC,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,mBAAmB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACtD,MAAM,IAAI,mBAAmB,CAC3B,CAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC,EAC3D,SAAS,CACV,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;CACF;AAED,SAAS,eAAe,CAAC,OAAsB;IAC7C,IAAI,OAAO,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC;IAC9C,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,YAAY,CAAC;IACtE,MAAM,GAAG,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACtC,0EAA0E;IAC1E,uEAAuE;IACvE,gCAAgC;IAChC,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG,YAAY,CAAC;IAChF,CAAC;IACD,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,4EAA4E;IAC5E,oBAAoB;IACpB,MAAM,GAAG,GAAI,UAAyE,CAAC,OAAO;QAC5F,EAAE,GAAG,CAAC;IACR,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;AAClC,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,OAAO,CAAC,CAAU;IACzB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAK,CAAuB,CAAC,IAAI,KAAK,YAAY,CAAC;AAC/F,CAAC;AAED,SAAS,UAAU;IACjB,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAClD,CAAC,CAAC,IAAI,GAAG,YAAY,CAAC;IACtB,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,YAAY,CAAI,OAAmB,EAAE,MAA+B;IAC3E,IAAI,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC;IAC5B,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACxD,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QAC3C,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE;YACR,IAAI,EAAE,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;YACjB,IAAI,EAAE,CAAC;YACP,MAAM,CAAC,KAAc,CAAC,CAAC;QACzB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CACjB,SAAiB,EACjB,QAAsB;IAEtB,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC;IACnF,IAAI,OAAO,eAAe,KAAK,UAAU,EAAE,CAAC;QAC1C,OAAO;YACL,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC;YACjB,UAAU,EAAE,GAAG,EAAE,CAAC,KAAK;SACxB,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,KAAgD,CAAC;IAErD,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClB,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,QAAQ,GAAG,IAAI,CAAC;YAChB,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC,EAAE,SAAS,CAAC,CAAC;IAChB,CAAC;IAED,MAAM,eAAe,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IACjD,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,QAAQ,CAAC,OAAO;YAAE,UAAU,CAAC,KAAK,EAAE,CAAC;;YACpC,QAAQ,CAAC,gBAAgB,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO;QACL,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO,EAAE,GAAG,EAAE;YACZ,IAAI,KAAK,KAAK,SAAS;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC7C,QAAQ,EAAE,mBAAmB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC1D,CAAC;QACD,UAAU,EAAE,GAAG,EAAE,CAAC,QAAQ;KAC3B,CAAC;AACJ,CAAC","sourcesContent":["import {\n  UnfazedAuthError,\n  UnfazedConfigError,\n  UnfazedGraphQLError,\n  UnfazedHTTPError,\n  UnfazedTimeoutError,\n  type GraphQLResponseError,\n} from \"./errors.js\";\n\n/** SDK version, sent as the User-Agent. Keep in sync with package.json. */\nexport const VERSION = \"0.6.0\";\n\n/**\n * Default GraphQL endpoint.\n *\n * Note this is the FULL endpoint, not an origin: the platform's own documented\n * convention (`UNFZ_API_URL=\"https://unfazed.dev/query\"`, and cmd/showcase-deploy\n * in the unfazed repo) treats the /query URL as the configurable unit, so the\n * SDK matches it rather than inventing a base-URL convention.\n */\nexport const DEFAULT_ENDPOINT = \"https://unfazed.dev/query\";\n\n/** Platform origin, used to derive the endpoint when only `baseUrl` is given. */\nexport const DEFAULT_BASE_URL = \"https://unfazed.dev\";\n\n/** Path of the GraphQL endpoint under an origin. */\nexport const GRAPHQL_PATH = \"/query\";\n\n/**\n * Environment variable holding the bearer token.\n *\n * This is the platform's documented name (docs/agent-deployments.md,\n * internal/agentdocs/reference.md). It accepts either an operator API token or\n * an agent access token from POST /agents/register — /query takes both as\n * plain bearers.\n */\nexport const TOKEN_ENV_VAR = \"UNFZ_API_TOKEN\";\n\n/** Environment variable holding the full GraphQL endpoint URL. */\nexport const ENDPOINT_ENV_VAR = \"UNFZ_API_URL\";\n\n/** Minimal structural type of the `fetch` the transport needs. */\nexport type FetchLike = (\n  input: string,\n  init: {\n    method: string;\n    headers: Record<string, string>;\n    body: string;\n    signal?: AbortSignal;\n  },\n) => Promise<{\n  ok: boolean;\n  status: number;\n  text(): Promise<string>;\n}>;\n\nexport interface ClientOptions {\n  /**\n   * Bearer token. Falls back to `UNFZ_API_TOKEN`. Get one from\n   * https://unfazed.dev/auth.md — the same token the MCP server uses.\n   */\n  token?: string;\n  /**\n   * Full GraphQL endpoint URL. Wins over `baseUrl`. Falls back to\n   * `UNFZ_API_URL`, then {@link DEFAULT_ENDPOINT}.\n   */\n  endpoint?: string;\n  /**\n   * Platform origin; `/query` is appended. Convenience for self-hosted or\n   * staging control planes where only the host differs.\n   */\n  baseUrl?: string;\n  /** Extra headers merged into every request. Authorization always wins. */\n  headers?: Record<string, string>;\n  /**\n   * Per-request timeout in ms. Default 60_000. Pass 0 to disable.\n   *\n   * Bounds the WHOLE request — connect, headers and reading the response body —\n   * so a proxy that answers with headers and then stalls still fails on time.\n   */\n  timeoutMs?: number;\n  /** Injection point for tests and instrumented/proxied transports. */\n  fetch?: FetchLike;\n  /** Overrides the default `unfazed-sdk/<version>` User-Agent. */\n  userAgent?: string;\n}\n\n/**\n * A GraphQL document.\n *\n * Structural rather than `string & {...}` on purpose: graphql-codegen emits\n * `TypedDocumentString`, a String SUBCLASS, which is not assignable to the\n * primitive `string`. Requiring only `toString()` plus the optional phantom\n * `__apiType` lets three things through with full inference:\n *\n *  - generated `TypedDocumentString` documents (types inferred),\n *  - documents assembled at runtime, like the batched writeFiles mutation,\n *  - plain template-literal strings a caller wrote by hand.\n */\nexport interface GraphQLDocument<TResult, TVariables> {\n  /** Phantom type carrier. Never called; present only to bind the generics. */\n  __apiType?: (variables: TVariables) => TResult;\n  toString(): string;\n}\n\n/** Result type carried by a typed document. */\nexport type ResultOf<T> = T extends GraphQLDocument<infer R, infer _V> ? R : unknown;\n\n/** Variables type carried by a typed document. */\nexport type VariablesOf<T> = T extends GraphQLDocument<infer _R, infer V> ? V : never;\n\n/** Per-request knobs. */\nexport interface RequestOptions {\n  signal?: AbortSignal;\n  timeoutMs?: number;\n  operationName?: string;\n}\n\n/**\n * Layer 1 — a typed, dependency-free GraphQL transport over `fetch`.\n *\n * This is the SDK's entire networking surface. It understands auth, timeouts\n * and the GraphQL error envelope, and nothing about deployments. The workflow\n * layer ({@link import(\"./unfazed.js\").Unfazed}) is built strictly on top of\n * it, so you can always drop down here for any operation the workflow layer\n * does not wrap — the schema has ~660 fields and the workflow layer\n * deliberately covers only the agent-facing ones.\n *\n * ```ts\n * const client = new UnfazedClient();               // reads UNFZ_API_TOKEN\n * const data = await client.query<{ whoami: { name: string } }, never>(\n *   `query { whoami { name } }`,\n * );\n * ```\n */\nexport class UnfazedClient {\n  /** Resolved GraphQL endpoint URL. */\n  readonly endpoint: string;\n\n  readonly #token: string;\n  readonly #headers: Record<string, string>;\n  readonly #timeoutMs: number;\n  readonly #fetch: FetchLike;\n\n  constructor(options: ClientOptions = {}) {\n    const token = options.token ?? readEnv(TOKEN_ENV_VAR);\n    if (!token) {\n      throw new UnfazedAuthError(\n        `unfazed: no API token. Pass { token } or set ${TOKEN_ENV_VAR}. ` +\n          `Get one at ${DEFAULT_BASE_URL}/auth.md`,\n      );\n    }\n    this.#token = token.trim();\n\n    this.endpoint = resolveEndpoint(options);\n\n    this.#headers = { ...(options.headers ?? {}) };\n    this.#timeoutMs = options.timeoutMs ?? 60_000;\n\n    const injected = options.fetch;\n    if (injected) {\n      this.#fetch = injected;\n    } else {\n      const globalFetch = (globalThis as { fetch?: unknown }).fetch;\n      if (typeof globalFetch !== \"function\") {\n        throw new UnfazedConfigError(\n          \"unfazed: no global fetch. Use Bun, Node >= 20, or pass { fetch } to the client.\",\n        );\n      }\n      this.#fetch = globalFetch.bind(globalThis) as FetchLike;\n    }\n\n    const ua = options.userAgent ?? `unfazed-sdk/${VERSION}`;\n    if (ua) this.#headers[\"User-Agent\"] = ua;\n  }\n\n  /** Runs a query document. Identical wire behaviour to {@link mutate}. */\n  query<TResult, TVariables>(\n    document: GraphQLDocument<TResult, TVariables>,\n    variables?: TVariables,\n    options?: RequestOptions,\n  ): Promise<TResult> {\n    return this.request(document, variables, options);\n  }\n\n  /**\n   * Runs a mutation document. Distinct from {@link query} for call-site\n   * readability only — GraphQL over HTTP POST makes no distinction.\n   */\n  mutate<TResult, TVariables>(\n    document: GraphQLDocument<TResult, TVariables>,\n    variables?: TVariables,\n    options?: RequestOptions,\n  ): Promise<TResult> {\n    return this.request(document, variables, options);\n  }\n\n  /**\n   * The single code path behind {@link query} and {@link mutate}.\n   *\n   * Throws {@link UnfazedHTTPError} on non-2xx, {@link UnfazedGraphQLError}\n   * when the body carries `errors`, {@link UnfazedTimeoutError} on timeout or\n   * abort. Resolves to the `data` object on success.\n   */\n  async request<TResult = unknown>(\n    document: string | { toString(): string },\n    variables?: unknown,\n    options: RequestOptions = {},\n  ): Promise<TResult> {\n    const timeoutMs = options.timeoutMs ?? this.#timeoutMs;\n    const { signal, cleanup, didTimeout } = makeSignal(timeoutMs, options.signal);\n\n    // `document` may be a TypedDocumentString (a String object). JSON.stringify\n    // would serialise that fine, but String(...) keeps the wire body a plain\n    // primitive regardless of how the caller obtained the document.\n    const body = JSON.stringify({\n      query: String(document),\n      ...(variables === undefined ? {} : { variables }),\n      ...(options.operationName ? { operationName: options.operationName } : {}),\n    });\n\n    // The deadline covers BOTH phases — headers AND body. A proxy that answers\n    // with headers and then stalls the body is a real failure mode, and\n    // stopping the clock at the end of `fetch()` would leave `response.text()`\n    // hanging forever. `untilAborted` additionally races the signal itself, so\n    // an injected transport that ignores `signal` still cannot outlive the\n    // timeout.\n    let response: Awaited<ReturnType<FetchLike>>;\n    let text: string;\n    try {\n      response = await untilAborted(\n        this.#fetch(this.endpoint, {\n          method: \"POST\",\n          headers: {\n            ...this.#headers,\n            \"Content-Type\": \"application/json\",\n            Accept: \"application/json\",\n            Authorization: `Bearer ${this.#token}`,\n          },\n          body,\n          ...(signal ? { signal } : {}),\n        }),\n        signal,\n      );\n      text = await untilAborted(response.text(), signal);\n    } catch (cause) {\n      if (didTimeout()) {\n        throw new UnfazedTimeoutError(`unfazed: request timed out after ${timeoutMs}ms`, { cause });\n      }\n      if (isAbort(cause)) {\n        throw new UnfazedTimeoutError(\"unfazed: request aborted\", { cause });\n      }\n      throw cause;\n    } finally {\n      cleanup();\n    }\n\n    if (!response.ok) {\n      throw new UnfazedHTTPError(response.status, text, this.endpoint);\n    }\n\n    let parsed: { data?: TResult; errors?: GraphQLResponseError[] };\n    try {\n      parsed = JSON.parse(text) as typeof parsed;\n    } catch {\n      throw new UnfazedHTTPError(response.status, text, this.endpoint);\n    }\n\n    // A GraphQL 200 can still be a failure, and can be a PARTIAL failure: the\n    // batched writeFiles document resolves each aliased field independently.\n    // Attaching `data` to the error is what lets a caller see which writes\n    // landed before the failing one.\n    if (parsed.errors?.length) {\n      throw new UnfazedGraphQLError(parsed.errors, parsed.data);\n    }\n    if (parsed.data === undefined || parsed.data === null) {\n      throw new UnfazedGraphQLError(\n        [{ message: \"response contained neither data nor errors\" }],\n        undefined,\n      );\n    }\n    return parsed.data;\n  }\n}\n\nfunction resolveEndpoint(options: ClientOptions): string {\n  if (options.endpoint) return options.endpoint;\n  if (options.baseUrl) return trimSlash(options.baseUrl) + GRAPHQL_PATH;\n  const env = readEnv(ENDPOINT_ENV_VAR);\n  // UNFZ_API_URL is documented as the full /query URL and is used verbatim.\n  // Tolerate a bare origin anyway, since that is the obvious mistake and\n  // guessing right costs nothing.\n  if (env) {\n    const trimmed = trimSlash(env);\n    return /\\/query$|\\/graphql$/.test(trimmed) ? trimmed : trimmed + GRAPHQL_PATH;\n  }\n  return DEFAULT_ENDPOINT;\n}\n\nfunction readEnv(name: string): string | undefined {\n  // Guarded: the SDK must also work in a browser or worker, where there is no\n  // `process` at all.\n  const env = (globalThis as { process?: { env?: Record<string, string | undefined> } }).process\n    ?.env;\n  return env?.[name] || undefined;\n}\n\nfunction trimSlash(u: string): string {\n  return u.replace(/\\/+$/, \"\");\n}\n\nfunction isAbort(e: unknown): boolean {\n  return typeof e === \"object\" && e !== null && (e as { name?: string }).name === \"AbortError\";\n}\n\nfunction abortError(): Error {\n  const e = new Error(\"The operation was aborted.\");\n  e.name = \"AbortError\";\n  return e;\n}\n\n/**\n * Settles with `promise`, or rejects the moment `signal` aborts.\n *\n * A global `fetch` honours the signal for headers and body alike, but an\n * injected {@link FetchLike} — a proxy, an instrumented transport, a test\n * double — need not. Racing the signal makes the timeout an upper bound on the\n * whole request regardless of what the transport does with it. The loser's\n * rejection is swallowed by the already-settled promise rather than surfacing\n * as an unhandled rejection.\n */\nfunction untilAborted<T>(promise: Promise<T>, signal: AbortSignal | undefined): Promise<T> {\n  if (!signal) return promise;\n  if (signal.aborted) return Promise.reject(abortError());\n  return new Promise<T>((resolve, reject) => {\n    const onAbort = () => reject(abortError());\n    signal.addEventListener(\"abort\", onAbort, { once: true });\n    const done = () => signal.removeEventListener(\"abort\", onAbort);\n    promise.then(\n      (value) => {\n        done();\n        resolve(value);\n      },\n      (error: unknown) => {\n        done();\n        reject(error as Error);\n      },\n    );\n  });\n}\n\n/**\n * Combines the request timeout with any caller-supplied signal.\n *\n * `didTimeout` is tracked separately from the abort so a caller's own\n * cancellation is not mislabelled as a timeout in the thrown message.\n */\nfunction makeSignal(\n  timeoutMs: number,\n  external?: AbortSignal,\n): { signal?: AbortSignal; cleanup: () => void; didTimeout: () => boolean } {\n  if (!timeoutMs && !external) return { cleanup: () => {}, didTimeout: () => false };\n  if (typeof AbortController !== \"function\") {\n    return {\n      ...(external ? { signal: external } : {}),\n      cleanup: () => {},\n      didTimeout: () => false,\n    };\n  }\n\n  const controller = new AbortController();\n  let timedOut = false;\n  let timer: ReturnType<typeof setTimeout> | undefined;\n\n  if (timeoutMs > 0) {\n    timer = setTimeout(() => {\n      timedOut = true;\n      controller.abort();\n    }, timeoutMs);\n  }\n\n  const onExternalAbort = () => controller.abort();\n  if (external) {\n    if (external.aborted) controller.abort();\n    else external.addEventListener(\"abort\", onExternalAbort, { once: true });\n  }\n\n  return {\n    signal: controller.signal,\n    cleanup: () => {\n      if (timer !== undefined) clearTimeout(timer);\n      external?.removeEventListener(\"abort\", onExternalAbort);\n    },\n    didTimeout: () => timedOut,\n  };\n}\n"]}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,eAAe,EAAoB,MAAM,kBAAkB,CAAC;AACpF,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GAEpB,MAAM,aAAa,CAAC;AAErB,2EAA2E;AAC3E,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AAE5D,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAEtD,oDAAoD;AACpD,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAC;AAErC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,gBAAgB,CAAC;AAE9C,kEAAkE;AAClE,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AA+F/C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,aAAa;IACxB,qCAAqC;IAC5B,QAAQ,CAAS;IAE1B,4EAA4E;IACnE,KAAK,CAA6C;IAClD,QAAQ,CAAyB;IACjC,UAAU,CAAS;IACnB,MAAM,CAAY;IAE3B,YAAY,UAAyB,EAAE;QACrC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,CAAC;QAExC,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC;QAC/B,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,GAAI,UAAkC,CAAC,KAAK,CAAC;YAC9D,IAAI,OAAO,WAAW,KAAK,UAAU,EAAE,CAAC;gBACtC,MAAM,IAAI,kBAAkB,CAC1B,iFAAiF,CAClF,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAc,CAAC;QAC1D,CAAC;QAED,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,IAAI,eAAe,OAAO,EAAE,CAAC;QAEzD,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;QAClD,IAAI,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;YAClB,IAAI,CAAC,KAAK,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YACrC,IAAI,CAAC,QAAQ,GAAG,UAAU,IAAI,gBAAgB,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GACV,OAAO,CAAC,KAAK,KAAK,KAAK;gBACrB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,eAAe,CAAC;oBACd,GAAG;oBACH,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/C,KAAK,EAAE,IAAI,CAAC,MAAM;oBAClB,+DAA+D;oBAC/D,SAAS,EAAE,EAAE,IAAI,eAAe,OAAO,EAAE;iBAC1C,CAAC,CAAC;YACT,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAClB,MAAM,IAAI,gBAAgB,CAAC,cAAc,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;YACjF,CAAC;YACD,IAAI,CAAC,KAAK,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;YACrC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;QACxC,CAAC;QAED,IAAI,CAAC,QAAQ,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;QAC9C,IAAI,EAAE;YAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC;IAC3C,CAAC;IAED;;;OAGG;IACH,IAAI,UAAU;QACZ,OAAO,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IACnD,CAAC;IAED,yEAAyE;IACzE,KAAK,CACH,QAA8C,EAC9C,SAAsB,EACtB,OAAwB;QAExB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IAED;;;OAGG;IACH,MAAM,CACJ,QAA8C,EAC9C,SAAsB,EACtB,OAAwB;QAExB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CACX,QAAyC,EACzC,SAAmB,EACnB,UAA0B,EAAE;QAE5B,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC;QAEvD,4EAA4E;QAC5E,yEAAyE;QACzE,gEAAgE;QAChE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC;YACvB,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;YACjD,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3E,CAAC,CAAC;QAEH,IAAI,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAClF,mEAAmE;QACnE,sEAAsE;QACtE,sCAAsC;QACtC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACrD,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC9C,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,MAA2D,CAAC;QAChE,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkB,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnE,CAAC;QAED,0EAA0E;QAC1E,yEAAyE;QACzE,uEAAuE;QACvE,iCAAiC;QACjC,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;YAC1B,MAAM,IAAI,mBAAmB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACtD,MAAM,IAAI,mBAAmB,CAC3B,CAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC,EAC3D,SAAS,CACV,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,MAAM;QACJ,OAAO,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9F,CAAC;IAED,KAAK,CAAC,KAAK,CACT,IAAY,EACZ,KAAa,EACb,SAAiB,EACjB,QAAiC;QAEjC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACxE,2EAA2E;QAC3E,oEAAoE;QACpE,2EAA2E;QAC3E,2EAA2E;QAC3E,uEAAuE;QACvE,WAAW;QACX,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,YAAY,CACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE;gBACzB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,GAAG,IAAI,CAAC,QAAQ;oBAChB,cAAc,EAAE,kBAAkB;oBAClC,MAAM,EAAE,kBAAkB;oBAC1B,aAAa,EAAE,UAAU,KAAK,EAAE;iBACjC;gBACD,IAAI;gBACJ,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9B,CAAC,EACF,MAAM,CACP,CAAC;YACF,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;YACzD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,UAAU,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,SAAS,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnB,MAAM,IAAI,mBAAmB,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AAED,qFAAqF;AACrF,SAAS,kBAAkB,CAAC,OAAsB,EAAE,GAAuC;IACzF,IAAI,OAAO,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC;IAC9C,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,YAAY,CAAC;IACtE,MAAM,OAAO,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACtC,0EAA0E;IAC1E,uEAAuE;IACvE,gCAAgC;IAChC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACnC,OAAO,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG,YAAY,CAAC;IAChF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,QAA4B,EAAE,UAA8B;IAClF,IAAI,QAAQ,IAAI,UAAU,EAAE,CAAC;QAC3B,OAAO,CACL,6BAA6B,QAAQ,6BAA6B,UAAU,IAAI;YAChF,SAAS,gBAAgB,IAAI,QAAQ,IAAI,aAAa,+BAA+B,aAAa,GAAG,CACtG,CAAC;IACJ,CAAC;IACD,OAAO,CACL,iCAAiC,aAAa,mCAAmC;QACjF,2BAA2B,aAAa,qBAAqB,gBAAgB,YAAY,CAC1F,CAAC;AACJ,CAAC;AAED,SAAS,UAAU;IACjB,4EAA4E;IAC5E,oBAAoB;IACpB,OAAQ,UAAyE,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;AACvG,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,OAAO,CAAC,CAAU;IACzB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAK,CAAuB,CAAC,IAAI,KAAK,YAAY,CAAC;AAC/F,CAAC;AAED,SAAS,UAAU;IACjB,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAClD,CAAC,CAAC,IAAI,GAAG,YAAY,CAAC;IACtB,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,YAAY,CAAI,OAAmB,EAAE,MAA+B;IAC3E,IAAI,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC;IAC5B,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IACxD,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QAC3C,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE;YACR,IAAI,EAAE,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;YACjB,IAAI,EAAE,CAAC;YACP,MAAM,CAAC,KAAc,CAAC,CAAC;QACzB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CACjB,SAAiB,EACjB,QAAsB;IAEtB,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC;IACnF,IAAI,OAAO,eAAe,KAAK,UAAU,EAAE,CAAC;QAC1C,OAAO;YACL,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC;YACjB,UAAU,EAAE,GAAG,EAAE,CAAC,KAAK;SACxB,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,KAAgD,CAAC;IAErD,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClB,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,QAAQ,GAAG,IAAI,CAAC;YAChB,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC,EAAE,SAAS,CAAC,CAAC;IAChB,CAAC;IAED,MAAM,eAAe,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IACjD,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,QAAQ,CAAC,OAAO;YAAE,UAAU,CAAC,KAAK,EAAE,CAAC;;YACpC,QAAQ,CAAC,gBAAgB,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO;QACL,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,OAAO,EAAE,GAAG,EAAE;YACZ,IAAI,KAAK,KAAK,SAAS;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;YAC7C,QAAQ,EAAE,mBAAmB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC1D,CAAC;QACD,UAAU,EAAE,GAAG,EAAE,CAAC,QAAQ;KAC3B,CAAC;AACJ,CAAC","sourcesContent":["import { LOGIN_COMMAND, openStoredLogin, type StoredLogin } from \"./credentials.js\";\nimport {\n  UnfazedAuthError,\n  UnfazedConfigError,\n  UnfazedGraphQLError,\n  UnfazedHTTPError,\n  UnfazedTimeoutError,\n  type GraphQLResponseError,\n} from \"./errors.js\";\n\n/** SDK version, sent as the User-Agent. Keep in sync with package.json. */\nexport const VERSION = \"0.6.1\";\n\n/**\n * Default GraphQL endpoint.\n *\n * Note this is the FULL endpoint, not an origin: the platform's own documented\n * convention (`UNFZ_API_URL=\"https://unfazed.dev/query\"`, and cmd/showcase-deploy\n * in the unfazed repo) treats the /query URL as the configurable unit, so the\n * SDK matches it rather than inventing a base-URL convention.\n */\nexport const DEFAULT_ENDPOINT = \"https://unfazed.dev/query\";\n\n/** Platform origin, used to derive the endpoint when only `baseUrl` is given. */\nexport const DEFAULT_BASE_URL = \"https://unfazed.dev\";\n\n/** Path of the GraphQL endpoint under an origin. */\nexport const GRAPHQL_PATH = \"/query\";\n\n/**\n * Environment variable holding the bearer token.\n *\n * This is the platform's documented name (docs/agent-deployments.md,\n * internal/agentdocs/reference.md). It accepts either an operator API token or\n * an agent access token from POST /agents/register — /query takes both as\n * plain bearers.\n */\nexport const TOKEN_ENV_VAR = \"UNFZ_API_TOKEN\";\n\n/** Environment variable holding the full GraphQL endpoint URL. */\nexport const ENDPOINT_ENV_VAR = \"UNFZ_API_URL\";\n\n/** Minimal structural type of the `fetch` the transport needs. */\nexport type FetchLike = (\n  input: string,\n  init: {\n    method: string;\n    headers: Record<string, string>;\n    body: string;\n    signal?: AbortSignal;\n  },\n) => Promise<{\n  ok: boolean;\n  status: number;\n  text(): Promise<string>;\n}>;\n\nexport interface ClientOptions {\n  /**\n   * Bearer token. Falls back to `UNFZ_API_TOKEN`, then to the login\n   * `npx unfazed login` stored (see {@link ClientOptions.login}). An agent gets\n   * one from https://unfazed.dev/auth.md — the same token the MCP server uses.\n   */\n  token?: string;\n  /**\n   * Use the stored login of `npx unfazed login`\n   * (`${XDG_CONFIG_HOME:-~/.config}/unfazed/credentials.json`) when no token\n   * is passed and `UNFZ_API_TOKEN` is unset. Its access token is refreshed\n   * before it expires and when the platform refuses it. Default `true`; it is\n   * only used for the endpoint it was issued by, and is the endpoint when none\n   * is configured.\n   */\n  login?: boolean;\n  /**\n   * Where `UNFZ_API_TOKEN`, `UNFZ_API_URL` and the stored login's location\n   * (`XDG_CONFIG_HOME`, `HOME`) are read from. Default: `process.env`.\n   */\n  env?: Record<string, string | undefined>;\n  /**\n   * Full GraphQL endpoint URL. Wins over `baseUrl`. Falls back to\n   * `UNFZ_API_URL`, then the stored login's endpoint, then\n   * {@link DEFAULT_ENDPOINT}.\n   */\n  endpoint?: string;\n  /**\n   * Platform origin; `/query` is appended. Convenience for self-hosted or\n   * staging control planes where only the host differs.\n   */\n  baseUrl?: string;\n  /** Extra headers merged into every request. Authorization always wins. */\n  headers?: Record<string, string>;\n  /**\n   * Per-request timeout in ms. Default 60_000. Pass 0 to disable.\n   *\n   * Bounds the WHOLE request — connect, headers and reading the response body —\n   * so a proxy that answers with headers and then stalls still fails on time.\n   */\n  timeoutMs?: number;\n  /** Injection point for tests and instrumented/proxied transports. */\n  fetch?: FetchLike;\n  /** Overrides the default `unfazed-sdk/<version>` User-Agent. */\n  userAgent?: string;\n}\n\n/**\n * A GraphQL document.\n *\n * Structural rather than `string & {...}` on purpose: graphql-codegen emits\n * `TypedDocumentString`, a String SUBCLASS, which is not assignable to the\n * primitive `string`. Requiring only `toString()` plus the optional phantom\n * `__apiType` lets three things through with full inference:\n *\n *  - generated `TypedDocumentString` documents (types inferred),\n *  - documents assembled at runtime, like the batched writeFiles mutation,\n *  - plain template-literal strings a caller wrote by hand.\n */\nexport interface GraphQLDocument<TResult, TVariables> {\n  /** Phantom type carrier. Never called; present only to bind the generics. */\n  __apiType?: (variables: TVariables) => TResult;\n  toString(): string;\n}\n\n/** Result type carried by a typed document. */\nexport type ResultOf<T> = T extends GraphQLDocument<infer R, infer _V> ? R : unknown;\n\n/** Variables type carried by a typed document. */\nexport type VariablesOf<T> = T extends GraphQLDocument<infer _R, infer V> ? V : never;\n\n/** Per-request knobs. */\nexport interface RequestOptions {\n  signal?: AbortSignal;\n  timeoutMs?: number;\n  operationName?: string;\n}\n\n/**\n * Layer 1 — a typed, dependency-free GraphQL transport over `fetch`.\n *\n * This is the SDK's entire networking surface. It understands auth, timeouts\n * and the GraphQL error envelope, and nothing about deployments. The workflow\n * layer ({@link import(\"./unfazed.js\").Unfazed}) is built strictly on top of\n * it, so you can always drop down here for any operation the workflow layer\n * does not wrap — the schema has ~660 fields and the workflow layer\n * deliberately covers only the agent-facing ones.\n *\n * ```ts\n * const client = new UnfazedClient();     // UNFZ_API_TOKEN, else `npx unfazed login`\n * const data = await client.query<{ whoami: { name: string } }, never>(\n *   `query { whoami { name } }`,\n * );\n * ```\n */\nexport class UnfazedClient {\n  /** Resolved GraphQL endpoint URL. */\n  readonly endpoint: string;\n\n  /** A fixed bearer token, or the stored login handing out refreshed ones. */\n  readonly #auth: { token: string } | { login: StoredLogin };\n  readonly #headers: Record<string, string>;\n  readonly #timeoutMs: number;\n  readonly #fetch: FetchLike;\n\n  constructor(options: ClientOptions = {}) {\n    const env = options.env ?? processEnv();\n\n    const injected = options.fetch;\n    if (injected) {\n      this.#fetch = injected;\n    } else {\n      const globalFetch = (globalThis as { fetch?: unknown }).fetch;\n      if (typeof globalFetch !== \"function\") {\n        throw new UnfazedConfigError(\n          \"unfazed: no global fetch. Use Bun, Node >= 20, or pass { fetch } to the client.\",\n        );\n      }\n      this.#fetch = globalFetch.bind(globalThis) as FetchLike;\n    }\n\n    const ua = options.userAgent ?? `unfazed-sdk/${VERSION}`;\n\n    const configured = configuredEndpoint(options, env);\n    const token = options.token ?? env[TOKEN_ENV_VAR];\n    if (token?.trim()) {\n      this.#auth = { token: token.trim() };\n      this.endpoint = configured ?? DEFAULT_ENDPOINT;\n    } else {\n      const stored =\n        options.login === false\n          ? {}\n          : openStoredLogin({\n              env,\n              ...(configured ? { endpoint: configured } : {}),\n              fetch: this.#fetch,\n              // The edge refuses some generic agents; always name ourselves.\n              userAgent: ua || `unfazed-sdk/${VERSION}`,\n            });\n      if (!stored.login) {\n        throw new UnfazedAuthError(noTokenMessage(configured, stored.other?.endpoint));\n      }\n      this.#auth = { login: stored.login };\n      this.endpoint = stored.login.endpoint;\n    }\n\n    this.#headers = { ...(options.headers ?? {}) };\n    this.#timeoutMs = options.timeoutMs ?? 60_000;\n    if (ua) this.#headers[\"User-Agent\"] = ua;\n  }\n\n  /**\n   * Where the bearer token comes from: `\"token\"` (passed or\n   * `UNFZ_API_TOKEN`) or `\"login\"` (the stored login of `npx unfazed login`).\n   */\n  get authSource(): \"token\" | \"login\" {\n    return \"login\" in this.#auth ? \"login\" : \"token\";\n  }\n\n  /** Runs a query document. Identical wire behaviour to {@link mutate}. */\n  query<TResult, TVariables>(\n    document: GraphQLDocument<TResult, TVariables>,\n    variables?: TVariables,\n    options?: RequestOptions,\n  ): Promise<TResult> {\n    return this.request(document, variables, options);\n  }\n\n  /**\n   * Runs a mutation document. Distinct from {@link query} for call-site\n   * readability only — GraphQL over HTTP POST makes no distinction.\n   */\n  mutate<TResult, TVariables>(\n    document: GraphQLDocument<TResult, TVariables>,\n    variables?: TVariables,\n    options?: RequestOptions,\n  ): Promise<TResult> {\n    return this.request(document, variables, options);\n  }\n\n  /**\n   * The single code path behind {@link query} and {@link mutate}.\n   *\n   * Throws {@link UnfazedHTTPError} on non-2xx, {@link UnfazedGraphQLError}\n   * when the body carries `errors`, {@link UnfazedTimeoutError} on timeout or\n   * abort. Resolves to the `data` object on success.\n   */\n  async request<TResult = unknown>(\n    document: string | { toString(): string },\n    variables?: unknown,\n    options: RequestOptions = {},\n  ): Promise<TResult> {\n    const timeoutMs = options.timeoutMs ?? this.#timeoutMs;\n\n    // `document` may be a TypedDocumentString (a String object). JSON.stringify\n    // would serialise that fine, but String(...) keeps the wire body a plain\n    // primitive regardless of how the caller obtained the document.\n    const body = JSON.stringify({\n      query: String(document),\n      ...(variables === undefined ? {} : { variables }),\n      ...(options.operationName ? { operationName: options.operationName } : {}),\n    });\n\n    let token = await this.#token();\n    let { response, text } = await this.#send(body, token, timeoutMs, options.signal);\n    // A stored login's access token can be refused before its recorded\n    // expiry (the clock, a sign-out elsewhere): refresh once and retry. A\n    // fixed token has nothing to refresh.\n    if (response.status === 401 && \"login\" in this.#auth) {\n      token = await this.#auth.login.refresh(token);\n      ({ response, text } = await this.#send(body, token, timeoutMs, options.signal));\n    }\n\n    if (!response.ok) {\n      throw new UnfazedHTTPError(response.status, text, this.endpoint);\n    }\n\n    let parsed: { data?: TResult; errors?: GraphQLResponseError[] };\n    try {\n      parsed = JSON.parse(text) as typeof parsed;\n    } catch {\n      throw new UnfazedHTTPError(response.status, text, this.endpoint);\n    }\n\n    // A GraphQL 200 can still be a failure, and can be a PARTIAL failure: the\n    // batched writeFiles document resolves each aliased field independently.\n    // Attaching `data` to the error is what lets a caller see which writes\n    // landed before the failing one.\n    if (parsed.errors?.length) {\n      throw new UnfazedGraphQLError(parsed.errors, parsed.data);\n    }\n    if (parsed.data === undefined || parsed.data === null) {\n      throw new UnfazedGraphQLError(\n        [{ message: \"response contained neither data nor errors\" }],\n        undefined,\n      );\n    }\n    return parsed.data;\n  }\n\n  #token(): Promise<string> {\n    return \"login\" in this.#auth ? this.#auth.login.token() : Promise.resolve(this.#auth.token);\n  }\n\n  async #send(\n    body: string,\n    token: string,\n    timeoutMs: number,\n    external: AbortSignal | undefined,\n  ): Promise<{ response: Awaited<ReturnType<FetchLike>>; text: string }> {\n    const { signal, cleanup, didTimeout } = makeSignal(timeoutMs, external);\n    // The deadline covers BOTH phases — headers AND body. A proxy that answers\n    // with headers and then stalls the body is a real failure mode, and\n    // stopping the clock at the end of `fetch()` would leave `response.text()`\n    // hanging forever. `untilAborted` additionally races the signal itself, so\n    // an injected transport that ignores `signal` still cannot outlive the\n    // timeout.\n    try {\n      const response = await untilAborted(\n        this.#fetch(this.endpoint, {\n          method: \"POST\",\n          headers: {\n            ...this.#headers,\n            \"Content-Type\": \"application/json\",\n            Accept: \"application/json\",\n            Authorization: `Bearer ${token}`,\n          },\n          body,\n          ...(signal ? { signal } : {}),\n        }),\n        signal,\n      );\n      const text = await untilAborted(response.text(), signal);\n      return { response, text };\n    } catch (cause) {\n      if (didTimeout()) {\n        throw new UnfazedTimeoutError(`unfazed: request timed out after ${timeoutMs}ms`, { cause });\n      }\n      if (isAbort(cause)) {\n        throw new UnfazedTimeoutError(\"unfazed: request aborted\", { cause });\n      }\n      throw cause;\n    } finally {\n      cleanup();\n    }\n  }\n}\n\n/** The endpoint the options or `UNFZ_API_URL` name, or undefined for the default. */\nfunction configuredEndpoint(options: ClientOptions, env: Record<string, string | undefined>): string | undefined {\n  if (options.endpoint) return options.endpoint;\n  if (options.baseUrl) return trimSlash(options.baseUrl) + GRAPHQL_PATH;\n  const fromEnv = env[ENDPOINT_ENV_VAR];\n  // UNFZ_API_URL is documented as the full /query URL and is used verbatim.\n  // Tolerate a bare origin anyway, since that is the obvious mistake and\n  // guessing right costs nothing.\n  if (fromEnv) {\n    const trimmed = trimSlash(fromEnv);\n    return /\\/query$|\\/graphql$/.test(trimmed) ? trimmed : trimmed + GRAPHQL_PATH;\n  }\n  return undefined;\n}\n\nfunction noTokenMessage(endpoint: string | undefined, otherLogin: string | undefined): string {\n  if (endpoint && otherLogin) {\n    return (\n      `unfazed: no API token for ${endpoint}: the stored login is for ${otherLogin}. ` +\n      `Run \\`${ENDPOINT_ENV_VAR}=${endpoint} ${LOGIN_COMMAND}\\`, or pass { token } / set ${TOKEN_ENV_VAR}.`\n    );\n  }\n  return (\n    `unfazed: not signed in. Run \\`${LOGIN_COMMAND}\\` to sign in with your account, ` +\n    `or pass { token } / set ${TOKEN_ENV_VAR} (an agent token: ${DEFAULT_BASE_URL}/auth.md).`\n  );\n}\n\nfunction processEnv(): Record<string, string | undefined> {\n  // Guarded: the SDK must also work in a browser or worker, where there is no\n  // `process` at all.\n  return (globalThis as { process?: { env?: Record<string, string | undefined> } }).process?.env ?? {};\n}\n\nfunction trimSlash(u: string): string {\n  return u.replace(/\\/+$/, \"\");\n}\n\nfunction isAbort(e: unknown): boolean {\n  return typeof e === \"object\" && e !== null && (e as { name?: string }).name === \"AbortError\";\n}\n\nfunction abortError(): Error {\n  const e = new Error(\"The operation was aborted.\");\n  e.name = \"AbortError\";\n  return e;\n}\n\n/**\n * Settles with `promise`, or rejects the moment `signal` aborts.\n *\n * A global `fetch` honours the signal for headers and body alike, but an\n * injected {@link FetchLike} — a proxy, an instrumented transport, a test\n * double — need not. Racing the signal makes the timeout an upper bound on the\n * whole request regardless of what the transport does with it. The loser's\n * rejection is swallowed by the already-settled promise rather than surfacing\n * as an unhandled rejection.\n */\nfunction untilAborted<T>(promise: Promise<T>, signal: AbortSignal | undefined): Promise<T> {\n  if (!signal) return promise;\n  if (signal.aborted) return Promise.reject(abortError());\n  return new Promise<T>((resolve, reject) => {\n    const onAbort = () => reject(abortError());\n    signal.addEventListener(\"abort\", onAbort, { once: true });\n    const done = () => signal.removeEventListener(\"abort\", onAbort);\n    promise.then(\n      (value) => {\n        done();\n        resolve(value);\n      },\n      (error: unknown) => {\n        done();\n        reject(error as Error);\n      },\n    );\n  });\n}\n\n/**\n * Combines the request timeout with any caller-supplied signal.\n *\n * `didTimeout` is tracked separately from the abort so a caller's own\n * cancellation is not mislabelled as a timeout in the thrown message.\n */\nfunction makeSignal(\n  timeoutMs: number,\n  external?: AbortSignal,\n): { signal?: AbortSignal; cleanup: () => void; didTimeout: () => boolean } {\n  if (!timeoutMs && !external) return { cleanup: () => {}, didTimeout: () => false };\n  if (typeof AbortController !== \"function\") {\n    return {\n      ...(external ? { signal: external } : {}),\n      cleanup: () => {},\n      didTimeout: () => false,\n    };\n  }\n\n  const controller = new AbortController();\n  let timedOut = false;\n  let timer: ReturnType<typeof setTimeout> | undefined;\n\n  if (timeoutMs > 0) {\n    timer = setTimeout(() => {\n      timedOut = true;\n      controller.abort();\n    }, timeoutMs);\n  }\n\n  const onExternalAbort = () => controller.abort();\n  if (external) {\n    if (external.aborted) controller.abort();\n    else external.addEventListener(\"abort\", onExternalAbort, { once: true });\n  }\n\n  return {\n    signal: controller.signal,\n    cleanup: () => {\n      if (timer !== undefined) clearTimeout(timer);\n      external?.removeEventListener(\"abort\", onExternalAbort);\n    },\n    didTimeout: () => timedOut,\n  };\n}\n"]}

package/dist/credentials.d.ts

@@ -0,0 +1,123 @@
+import type { FetchLike } from "./client.js";
+/** The command that writes the stored login. Error messages point at it. */
+export declare const LOGIN_COMMAND = "npx unfazed login";
+/** The stored login's file name, under {@link credentialsDir}. */
+export declare const CREDENTIALS_FILE = "credentials.json";
+/** The access token is refreshed once it has less than this left. */
+export declare const REFRESH_MARGIN_MS = 60000;
+/** What `unfazed login` writes. Field names follow OAuth's own. */
+export interface StoredCredentials {
+    version: 1;
+    /** The GraphQL endpoint the login is for, e.g. `https://unfazed.dev/query`. */
+    endpoint: string;
+    /** The OAuth issuer that signed the person in, e.g. `https://unfazed.dev`. */
+    issuer: string;
+    token_endpoint: string;
+    /** RFC 7009 revocation endpoint, when the server advertises one. */
+    revocation_endpoint?: string;
+    /** The OAuth client `unfazed login` registered (a public client: no secret). */
+    client_id: string;
+    access_token: string;
+    refresh_token?: string;
+    /** When the access token expires (ISO 8601). Unset: never refreshed proactively. */
+    expires_at?: string;
+    scope?: string;
+    /** Who signed in, from GraphQL `whoami` at login. Display only. */
+    account?: {
+        kind?: string;
+        user_id?: string;
+        name?: string;
+    };
+    created_at?: string;
+    updated_at?: string;
+}
+type Env = Record<string, string | undefined>;
+/** `${XDG_CONFIG_HOME:-~/.config}/unfazed`, or undefined where there is no home. */
+export declare function credentialsDir(env?: Env): string | undefined;
+/** Where the stored login lives, or undefined where there is no home directory. */
+export declare function credentialsPath(env?: Env): string | undefined;
+/**
+ * Reads the stored login. `undefined` when there is none (or no filesystem on
+ * this runtime); throws {@link UnfazedConfigError} when the file is there but
+ * unusable, saying to log in again.
+ */
+export declare function readCredentials(path: string): StoredCredentials | undefined;
+/**
+ * Writes the stored login atomically with mode 0600 (its directory 0700): a
+ * temporary file created exclusively with that mode, then renamed over the
+ * old one, so a reader never sees half a file and the tokens are never
+ * readable by anyone else, not even for a moment.
+ */
+export declare function writeCredentials(path: string, credentials: StoredCredentials): void;
+/** Deletes the stored login. Returns whether there was one. */
+export declare function deleteCredentials(path: string): boolean;
+/** Whether the access token is expired or within {@link REFRESH_MARGIN_MS} of it. */
+export declare function needsRefresh(credentials: StoredCredentials, now?: number): boolean;
+/** The token endpoint's answer to a code or refresh grant. */
+export interface TokenResponse {
+    access_token: string;
+    refresh_token?: string;
+    token_type?: string;
+    expires_in?: number;
+    scope?: string;
+}
+/** Turns a token response into the stored fields it replaces. */
+export declare function tokenFields(response: TokenResponse, previous?: Pick<StoredCredentials, "refresh_token" | "scope">, now?: number): Pick<StoredCredentials, "access_token" | "refresh_token" | "expires_at" | "scope">;
+/**
+ * Posts a form to an OAuth endpoint and parses its JSON answer. On an OAuth
+ * error the thrown message carries only `error` and `error_description` —
+ * never the request, which holds the secrets.
+ */
+export declare function postTokenForm(fetch: FetchLike, url: string, form: Record<string, string>, userAgent: string, signal?: AbortSignal): Promise<{
+    status: number;
+    body: Record<string, unknown>;
+}>;
+/** `error: description` from an OAuth error body, or the HTTP status. */
+export declare function oauthErrorText(status: number, body: Record<string, unknown>): string;
+/**
+ * Exchanges the stored refresh token for a new pair. Throws
+ * {@link UnfazedAuthError} saying to log in again when the server refuses it.
+ */
+export declare function refreshCredentials(credentials: StoredCredentials, fetch: FetchLike, userAgent: string, signal?: AbortSignal): Promise<StoredCredentials>;
+/**
+ * The stored login as a token source for one client: hands out the access
+ * token, refreshing it before it expires and when the platform refuses it.
+ *
+ * Several processes may share the file (the Workflow CLI's web UI, a script,
+ * `npx unfazed whoami`): before refreshing, the file is read again and a token some
+ * other process already refreshed is adopted instead. Two that refresh at the
+ * same moment both end up with valid pairs: unfazed keeps a rotated refresh
+ * token exchangeable for a short grace window for exactly that race.
+ */
+export declare class StoredLogin {
+    #private;
+    readonly path: string;
+    constructor(path: string, credentials: StoredCredentials, fetch: FetchLike, userAgent: string);
+    /** The login's GraphQL endpoint. */
+    get endpoint(): string;
+    /** The current credentials (for display; the caller must not print tokens). */
+    get credentials(): StoredCredentials;
+    /** An access token that is not about to expire. */
+    token(): Promise<string>;
+    /**
+     * A token other than `stale`: one another process already wrote, else a
+     * freshly refreshed one. Concurrent callers share one refresh.
+     */
+    refresh(stale: string): Promise<string>;
+}
+/**
+ * Opens the stored login for `endpoint` (undefined: whichever endpoint the
+ * login is for). Returns undefined when there is no login, or when it is for
+ * another endpoint — a token is never sent anywhere but where it was issued.
+ */
+export declare function openStoredLogin(options: {
+    env: Env;
+    endpoint?: string;
+    fetch: FetchLike;
+    userAgent: string;
+}): {
+    login?: StoredLogin;
+    other?: StoredCredentials;
+};
+export declare function sameEndpoint(a: string, b: string): boolean;
+export {};