@alxia/react-router 0.13.0 → 0.14.0

package/README.md

@@ -932,6 +932,56 @@ declare function fetchVersions(): Promise<{ en: string; fr: string }>;
 The [errors guide](https://github.com/softistx/alxia/blob/develop/packages/react-router/docs/guide/errors.md)
 has the rest.
 
+## Sessions for a BFF
+
+An app that renders its pages and calls a GraphQL API that signs users in
+with `@nxgt/janus` keeps the API's token in its own HttpOnly cookie.
+`@alxia/react-router/session` holds that session's server side, built on
+`/errors`; `/session/model` imports nothing and is safe in a component.
+Neither adds a peer.
+
+```ts
+// app/session.server.ts
+import { sessionCookies, signInFlow } from '@alxia/react-router/session';
+import { errors, json } from './errors.server'; // createApiErrors, jsonActions
+import { SignOutMutation, execute } from './api.server';
+
+export const cookies = sessionCookies({
+	session: 'my-app_session',
+	challenge: 'my-app_challenge',
+	secure: !import.meta.env.DEV,
+});
+
+export const signIn = signInFlow({
+	cookies,
+	errors,
+	json,
+	revoke: (token, request) =>
+		execute(SignOutMutation, {}, { token, signal: request.signal }),
+	attemptsLeft: (count, language) => `${count} tries left`,
+});
+```
+
+```ts
+// app/routes/sign-in.tsx
+export async function action({ context, request }: Route.ActionArgs) {
+	const { language } = alxiaOf(context);
+	json.requireJsonPost(request); // a form posted before hydration goes back
+	const input = await json.readInput(request, SignInInput);
+	return signIn.signInStep(
+		async () => toAnswer((await execute(SignInMutation, input)).signIn),
+		{ request, language, next: signIn.nextParam(request), extra: {} },
+	);
+}
+```
+
+A signed-in answer redirects to `next` (kept on the site by `safeNext`) with
+the session cookie set; a second factor goes to the code page; a refusal stays
+on the form. `stepUpSteps` asks for a code before a sensitive action, and
+`authLinks` serves the pages a mail's link opens. The
+[session guide](https://github.com/softistx/alxia/blob/develop/packages/react-router/docs/guide/session.md)
+has a complete sign-in route and the rest.
+
 ## Traps
 
 - **A context key made in `app/` reaches the loaders only through the
@@ -1054,6 +1104,7 @@ From `@alxia/react-router/errors` (`react-router` is its only package import, an
 | `isApiErrorLike(error)` | whether `error` is an `@nxgt/graphql-client` `ApiError`, like the client's `isApiError`, plus a numeric `status`, which `ApiErrorLike` promises; it holds across two copies of the client |
 | `ApiErrorLike`, `ApiErrorEntryLike`, `ApiErrorExtensionsLike`, `ApiErrorParamsLike`, `ApiFieldErrorLike` | the shape of the refusal: `errors`, `code`, `status`, `requestId?`, and each error's `extensions` (`code`, `params`, `fields`, `field`, `minutes`, `retryAfter`) |
 | `waitMinutes(extensions)` | the minutes of a throttle's wait: `minutes` (at least one), else `retryAfter` rounded up |
+| `attemptsLeftOf(error)` | the tries a refused code leaves, as `@nxgt/janus` counts them: `extensions.attemptsLeft` of the first error, else `params.attemptsLeft`; `undefined` when it is not a whole number from 0 up |
 | `REQUEST_ID_HEADER`, `requestIdOf(response)` | `x-request-id`, and the id a response carries, if the API sent one |
 | `nextOf(url)` | the path and search of the page a request is for, without React Router's `.data`, `/_.data`, `_routes` and empty `index`; it never starts with two slashes, but an app still validates `next` before redirecting to it |
 | `FormErrors` | what a form action answers when the API refused the input: `fieldErrors` by field and a `formError` (`undefined` when every message sits under a field), already translated; `submitForm` answers it |
@@ -1072,6 +1123,32 @@ From `@alxia/react-router/errors` (`react-router` is its only package import, an
 | `useJsonFetcher(key?, action?)`, `JsonBody` | a fetcher that posts JSON: `{ fetcher, post(body, to?), busy }`; `to` is the action of one call |
 | `StandardSchemaV1` | the Standard Schema v1 type `readInput` takes, declared in `/errors` (type only, so no `@alxia/core`; `readInput`'s output is inferred from the schema's `~standard.types`); a Zod 4, Valibot or ArkType schema fits |
 
+From `@alxia/react-router/session` (`react-router` and `/errors`' files are its only imports):
+
+| export | |
+| --- | --- |
+| `sessionCookies({ session, challenge, secure, challengePath?, challengeSeconds? })`, `SessionCookies`, `SessionCookiesOptions`, `CookieSession` | the session and second-factor challenge cookies, `HttpOnly; SameSite=Lax`, `__Host-` and `__Secure-` when `secure` (required, never read from the environment): `commit(token, expiresAt)`, `read(request)`, `token(request)`, `destroy()`, `refreshed(session, expiresAt)` (a `Set-Cookie` only when the expiry moved), `commitChallenge`, `challengeOf`, `destroyChallenge`, `signInPageHeaders(deadSession)` and `names` (the cookie names as sent, prefixes included); a cookie written by an app's own code in `<expiry ms>.<token>` is read as it is |
+| `serializeCookie(name, value, { maxAge, path?, secure })`, `readCookie(request, name)`, `secondsUntil(expiresAt, now?)`, `SerializeOptions` | the bytes `sessionCookies` writes, for the cookies of your own; a name that is not an RFC 6265 token throws a `TypeError` |
+| `signInFlow({ cookies, errors, json, revoke, attemptsLeft, paths?, clear?, unavailable?, codes?, endedParam? })`, `SignInFlow`, `SignInFlowOptions` | the server side of the sign-in pages, which also exposes what it was built with (`cookies`, `errors`, `json`, `attemptsLeft`, `unavailable(language)`, `clear()`) and `guard(request)`, the check an app's own POST step runs first: `nextParam`, `signInRedirect`, `landing`, `landReplacing` (revokes the session the browser held), `signInStep` (a same-site JSON post only; an API refusal as the form's message and status, an unreachable API as a 503), `readCodeInput`, `codeStep`, `codeRefusal` (with the tries left), `revokeSession`, `signOut` (JSON and same-origin only; it clears the challenge cookie too), `viewer` (`null` for a 401, `undefined` when unknown) and `requireViewer` (throws the sign-in redirect) |
+| `SignInAnswer`, `SignInFormError`, `SignInStayed`, `SignInCodes` | what a step answers (`signedIn`, `secondFactor` or `other`), a form step's answer when it stays on the page, and the `codes` option (`invalidCode`, `challengeOver`) |
+| `stepUpSteps({ signIn, spent, locked?, wording?, codes? })`, `StepUpSteps`, `StepUpStepsOptions`, `StepUpCall` | a step-up for a route's action, reading the flow's `errors`, `json` and `attemptsLeft`, each step taking `{ request, language }` and refusing a post that is not a same-site JSON one: `request(run, { request, language })` answers the challenge and how it is confirmed (a throttled mail is `error: 'throttled'` with `retryAfter`), `confirm(run, { request, language, via? })` answers `error: 'invalid'` with the tries left (and `locked: true` for an app or recovery code with none left), `expired` or `failed`; `request` may answer `throttled` with `retryAfter`; and `isStepUpRequired(error)` |
+| `StepUpCodes`, `StepUpStayed`, `INVALID_CODE`, `CHALLENGE_OVER`, `MAIL_THROTTLED`, `STEP_UP_REQUIRED`, `STEP_UP_OVER` | the `codes` option (`invalidCode`, `challengeOver`, `stepUpRequired`, `mailThrottled`), a step's answer that stays on the page, and janus's default codes, which an app can extend |
+| `authLinks({ signIn, codes?, wording?, start?, resetDone?, invalidState? })`, `AuthLinks`, `AuthLinksOptions`, `AuthLinksCodes` | the pages a mail's link opens, over the flow's cookies, errors and json: `linkArgs`, `spendToken(run, { request, language, path, states, fields? })`, `answerOf`, `landByLink`, `afterReset` (clears the session, the challenge and the flow's cookies), `requestLink(run, { request, language })` (a wait answers `throttled: true` and `retryAfter` when the API gives the seconds; `wording` words every refusal that is not a field's), `statePath` and `ended` |
+| `Spent`, `SpendOptions`, `LinkStayed`, `RequestLinkAnswer` | their types |
+| `TOKEN_PAGE_HEADERS` | `Referrer-Policy: no-referrer` and `X-Robots-Tag: noindex, nofollow`, for a page whose URL carries a token |
+
+From `@alxia/react-router/session/model` (no import at all):
+
+| export | |
+| --- | --- |
+| `safeNext(value)`, `HOME` | `value` when it is a path of this site (search and hash kept), else `/` (`HOME`): a `//`, a scheme, a backslash, a control character, more than 2000 characters or a dot segment that leaves the site |
+| `signInPath(next, { query?, path? }?)` (`path` must be a path of this site with no query or fragment, a `TypeError` otherwise), `secondFactorPath(next)`, `SIGN_IN_PATHS`, `SignInPaths` | the sign-in page's URL coming back to `next`, the second-factor page's, and the default paths `/sign-in` and `/sign-in/second-factor` |
+| `TOTP_CODE` | the regular expression of an authenticator app's code: six digits |
+| `SecondFactorKind`, `SignInStatus`, `StepUpVia` | `'code' \| 'recovery'`, `'signedIn' \| 'secondFactor'` and `'email' \| 'secondFactor'` |
+| `stepUpReducer`, `INITIAL_STEP_UP`, `StepUpState`, `StepUpAction`, `StepUpPhase` | the step-up's state on the page, with no React: `phase`, `via`, `challenge`, `attemptsLeft`, `locked`, `error`, `message` (the last refusal worded), `retryAfter`, `pending`, `resent` |
+| `stepUpProps(state)`, `StepUpProps` | what a code form shows (`via`, `attemptsLeft`, `locked`, `error`, `retryAfter`, `pending`, `resent`; never the challenge or the message), for a step-up dialog's props |
+| `StepUpRequestAnswer`, `StepUpConfirmAnswer`, `StepUpError` | what `stepUpSteps` answers, which the reducer takes as it is; `StepUpError` is `'invalid' \| 'expired' \| 'failed' \| 'throttled'` |
+
 From `@alxia/react-router/document`:
 
 | export | |
@@ -1108,6 +1185,7 @@ The `alxia-react-router` bin, run with `bunx`:
 - [A CSP nonce](https://github.com/softistx/alxia/blob/develop/packages/react-router/docs/guide/csp-nonce.md), [Beside the pages](https://github.com/softistx/alxia/blob/develop/packages/react-router/docs/guide/beside-the-pages.md) (middlewares, routes, WebSockets, the client's files), [OpenAPI](https://github.com/softistx/alxia/blob/develop/packages/react-router/docs/guide/openapi.md), [Testing](https://github.com/softistx/alxia/blob/develop/packages/react-router/docs/guide/testing.md) and [Deploying](https://github.com/softistx/alxia/blob/develop/packages/react-router/docs/guide/deploying.md), with Docker.
 - [Installable and offline](https://github.com/softistx/alxia/blob/develop/packages/react-router/docs/guide/pwa.md): what the subpaths hold, the worker's contract, the worker, what it caches, the offline page, building the worker with `alxia()` or `buildWorker`, the hooks in React, registering the worker and offering an update, serving the worker's script, the web app manifest, and clearing at sign-out.
 - [An API's refusals](https://github.com/softistx/alxia/blob/develop/packages/react-router/docs/guide/errors.md): what `/errors` holds, recognising an API error, the request id, the page a request is for, the catalogue store, the form checks in the API's words, the provider, wording a refusal, loaders and the error page, actions, JSON actions and CSRF, and keeping the catalogue fresh.
+- [A BFF session](https://github.com/softistx/alxia/blob/develop/packages/react-router/docs/guide/session.md): redirects that stay on the site, the cookies, the sign-in route, the second factor, the viewer and sign-out, the step-up, and the pages a mail's link opens.
 - [Troubleshooting](https://github.com/softistx/alxia/blob/develop/packages/react-router/docs/troubleshooting.md): each message, and the traps that print none.
 - [Roadmap](https://github.com/softistx/alxia/blob/develop/packages/react-router/docs/roadmap.md): what is coming, and what is not planned.
 - [Example](https://github.com/softistx/alxia/tree/develop/examples/react-router): the official template, these four changes, then an `app/server.ts` with a session, an `/api`, secure headers with a nonce and a streamed page.

package/dist/chunks/index-0tyw54ad.js

@@ -0,0 +1,160 @@
+// src/session/model/safe-next.ts
+var HOME2 = "/";
+var BASE = "http://next.invalid";
+function safeNext2(value) {
+  if (!value || value.length > 2000)
+    return HOME2;
+  if (!value.startsWith("/") || value.startsWith("//"))
+    return HOME2;
+  if (/[\\\p{Cc}\s]/u.test(value))
+    return HOME2;
+  try {
+    const url = new URL(value, BASE);
+    const path = `${url.pathname}${url.search}${url.hash}`;
+    if (url.origin !== BASE || path.startsWith("//"))
+      return HOME2;
+    return path;
+  } catch {
+    return HOME2;
+  }
+}
+
+// src/session/model/site-path.ts
+function sitePath(path, {
+  label,
+  query = false
+}) {
+  if (safeNext2(path) !== path || !query && /[?#]/.test(path)) {
+    const shown = query ? path : path.replace(/[?#].*$/s, "?…");
+    throw new TypeError(`${label} must be a path of this site${query ? "" : " with no query or fragment"}, starting with a single "/"; got ${JSON.stringify(shown)}.`);
+  }
+  return path;
+}
+
+// src/session/model/paths.ts
+var SIGN_IN_PATHS2 = {
+  signIn: "/sign-in",
+  secondFactor: "/sign-in/second-factor"
+};
+function withNext(path, next, query) {
+  const params = new URLSearchParams(query);
+  const target = safeNext2(next);
+  if (target !== HOME2)
+    params.set("next", target);
+  const search = params.toString();
+  return search ? `${path}?${search}` : path;
+}
+function signInPath2(next, options = {}) {
+  const path = options.path === undefined ? SIGN_IN_PATHS2.signIn : sitePath(options.path, { label: "signInPath(): options.path" });
+  return withNext(path, next, options.query);
+}
+function secondFactorPath2(next, path = SIGN_IN_PATHS2.secondFactor) {
+  return withNext(path, next);
+}
+// src/session/model/second-factor.ts
+var TOTP_CODE2 = /^\d{6}$/;
+// src/session/model/step-up.ts
+var INITIAL_STEP_UP2 = {
+  phase: "idle",
+  locked: false,
+  pending: false,
+  resent: false
+};
+function requested(state, answer) {
+  if (!answer.ok) {
+    return {
+      ...state,
+      phase: state.challenge ? "code" : "idle",
+      error: answer.error,
+      message: answer.message,
+      retryAfter: answer.retryAfter,
+      pending: false,
+      resent: false
+    };
+  }
+  return {
+    phase: "code",
+    via: answer.via,
+    challenge: answer.challenge,
+    locked: false,
+    pending: false,
+    resent: state.challenge !== undefined
+  };
+}
+function refused(state, answer) {
+  const none = answer.attemptsLeft === 0;
+  const over = answer.error === "expired" || none && state.via === "email";
+  if (over) {
+    return {
+      phase: "idle",
+      ...state.via ? { via: state.via } : {},
+      locked: false,
+      error: "expired",
+      message: answer.message,
+      pending: false,
+      resent: false
+    };
+  }
+  return {
+    ...state,
+    phase: "code",
+    error: answer.error,
+    message: answer.message,
+    retryAfter: undefined,
+    attemptsLeft: answer.attemptsLeft,
+    locked: answer.locked || none,
+    pending: false,
+    resent: false
+  };
+}
+function stepUpReducer2(state, action) {
+  switch (action.type) {
+    case "start":
+      return {
+        ...state,
+        phase: state.challenge ? "code" : "requesting",
+        error: undefined,
+        message: undefined,
+        retryAfter: undefined,
+        pending: true,
+        resent: false
+      };
+    case "requested":
+      return requested(state, action.answer);
+    case "submit":
+      return {
+        ...state,
+        phase: "confirming",
+        error: undefined,
+        message: undefined,
+        retryAfter: undefined,
+        pending: true
+      };
+    case "confirmed":
+      return action.answer.ok ? {
+        phase: "done",
+        ...state.via ? { via: state.via } : {},
+        locked: false,
+        pending: false,
+        resent: false
+      } : refused(state, action.answer);
+    case "release":
+      return INITIAL_STEP_UP2;
+  }
+}
+// src/session/model/step-up-props.ts
+function stepUpProps2(state) {
+  return {
+    ...state.via ? { via: state.via } : {},
+    ...state.attemptsLeft === undefined ? {} : { attemptsLeft: state.attemptsLeft },
+    locked: state.locked,
+    ...state.error ? { error: state.error } : {},
+    ...state.retryAfter === undefined ? {} : { retryAfter: state.retryAfter },
+    pending: state.pending,
+    resent: state.resent
+  };
+}
+export { HOME2, safeNext2, sitePath, SIGN_IN_PATHS2, signInPath2, secondFactorPath2, TOTP_CODE2, INITIAL_STEP_UP2, stepUpReducer2, stepUpProps2 };
+
+//# debugId=01582ABF6CEE43FB64756E2164756E21
+//# sourceMappingURL=index-0tyw54ad.js.map

package/dist/chunks/index-0tyw54ad.js.map

@@ -0,0 +1,15 @@
+{
+  "version": 3,
+  "sources": ["../src/session/model/safe-next.ts", "../src/session/model/site-path.ts", "../src/session/model/paths.ts", "../src/session/model/second-factor.ts", "../src/session/model/step-up.ts", "../src/session/model/step-up-props.ts"],
+  "sourcesContent": [
+    "/** Where a sign-in lands when `next` is missing or unsafe. */\nexport const HOME = '/';\n\n/** The base a `next` is resolved against; `.invalid` never resolves. */\nconst BASE = 'http://next.invalid';\n\n/**\n * The `next` a sign-in may redirect to: a path of this site only. Anything\n * that could leave it (`//host`, `/\\host`, `https://…`, `javascript:…`, a\n * control character a browser would strip, a value over 2000 characters)\n * falls back to `/`. The path is read after normalisation, so `/a/..//host`\n * is refused too.\n *\n * @example\n * safeNext('/orders?page=2'); // '/orders?page=2'\n * safeNext('//evil.test'); // '/'\n */\nexport function safeNext(value: string | null | undefined): string {\n\tif (!value || value.length > 2000) return HOME;\n\tif (!value.startsWith('/') || value.startsWith('//')) return HOME;\n\t// Browsers read `\\` as `/` and drop tabs and newlines in URLs.\n\tif (/[\\\\\\p{Cc}\\s]/u.test(value)) return HOME;\n\ttry {\n\t\tconst url = new URL(value, BASE);\n\t\tconst path = `${url.pathname}${url.search}${url.hash}`;\n\t\t// Dot segments can collapse into `//host` again: check what is answered.\n\t\tif (url.origin !== BASE || path.startsWith('//')) return HOME;\n\t\treturn path;\n\t} catch {\n\t\treturn HOME;\n\t}\n}\n",
+    "import { safeNext } from './safe-next';\n\n/**\n * A path of this site, or a `TypeError` naming `label`. With no `query`, the\n * path holds no `?` or `#` either, and the message prints it only up to\n * there, since what follows may be a token.\n */\nexport function sitePath(\n\tpath: string,\n\t{\n\t\tlabel,\n\t\tquery = false,\n\t}: { readonly label: string; readonly query?: boolean | undefined },\n): string {\n\tif (safeNext(path) !== path || (!query && /[?#]/.test(path))) {\n\t\tconst shown = query ? path : path.replace(/[?#].*$/s, '?…');\n\t\tthrow new TypeError(\n\t\t\t`${label} must be a path of this site${query ? '' : ' with no query or fragment'}, starting with a single \"/\"; got ${JSON.stringify(shown)}.`,\n\t\t);\n\t}\n\treturn path;\n}\n",
+    "import { HOME, safeNext } from './safe-next';\nimport { sitePath } from './site-path';\n\n/** The two pages of a sign-in. */\nexport interface SignInPaths {\n\treadonly signIn: string;\n\treadonly secondFactor: string;\n}\n\n/** The defaults: `/sign-in` and `/sign-in/second-factor`. */\nexport const SIGN_IN_PATHS: SignInPaths = {\n\tsignIn: '/sign-in',\n\tsecondFactor: '/sign-in/second-factor',\n};\n\nfunction withNext(\n\tpath: string,\n\tnext: string,\n\tquery?: Record<string, string>,\n): string {\n\tconst params = new URLSearchParams(query);\n\tconst target = safeNext(next);\n\tif (target !== HOME) params.set('next', target);\n\tconst search = params.toString();\n\treturn search ? `${path}?${search}` : path;\n}\n\n/**\n * The sign-in page's URL, coming back to `next` (none for the home page, and\n * `next` goes through `safeNext`). `query` adds parameters, such as\n * `{ expired: '1' }`; `path` replaces `/sign-in` and must be a path of this\n * site with no query or fragment (a `TypeError` otherwise).\n *\n * @example\n * signInPath('/orders'); // '/sign-in?next=%2Forders'\n * signInPath('/', { query: { expired: '1' } }); // '/sign-in?expired=1'\n */\nexport function signInPath(\n\tnext: string,\n\toptions: {\n\t\treadonly query?: Record<string, string> | undefined;\n\t\treadonly path?: string | undefined;\n\t} = {},\n): string {\n\tconst path =\n\t\toptions.path === undefined\n\t\t\t? SIGN_IN_PATHS.signIn\n\t\t\t: sitePath(options.path, { label: 'signInPath(): options.path' });\n\treturn withNext(path, next, options.query);\n}\n\n/** The second-factor page's URL, coming back to `next` as `signInPath` does. */\nexport function secondFactorPath(\n\tnext: string,\n\tpath: string = SIGN_IN_PATHS.secondFactor,\n): string {\n\treturn withNext(path, next);\n}\n",
+    "/** A code of an authenticator app: six digits. */\nexport const TOTP_CODE: RegExp = /^\\d{6}$/;\n\n/**\n * What a second-factor form sends: `code` is the issued code (an app's, or\n * the one mailed), `recovery` a recovery code. Janus has no name for it, only\n * `confirm` and `recover`.\n */\nexport type SecondFactorKind = 'code' | 'recovery';\n\n/** How a sign-in ended, in `@nxgt/janus`'s words (`SignInResult['status']`). */\nexport type SignInStatus = 'signedIn' | 'secondFactor';\n\n/**\n * How a step-up is confirmed, in `@nxgt/janus`'s words: a code mailed to the\n * current address, or the account's second factor.\n */\nexport type StepUpVia = 'email' | 'secondFactor';\n",
+    "import type { StepUpVia } from './second-factor';\nimport type {\n\tStepUpConfirmAnswer,\n\tStepUpError,\n\tStepUpRequestAnswer,\n} from './step-up-answers';\n\n/** Where a step-up is. */\nexport type StepUpPhase =\n\t| 'idle'\n\t| 'requesting'\n\t| 'code'\n\t| 'confirming'\n\t| 'done';\n\nexport interface StepUpState {\n\treadonly phase: StepUpPhase;\n\t/** How the challenge held (or the last one) is confirmed. */\n\treadonly via?: StepUpVia | undefined;\n\t/** The challenge held. A secret: never in a URL, a log or loader data. */\n\treadonly challenge?: string | undefined;\n\t/** The tries the last refused code left. */\n\treadonly attemptsLeft?: number | undefined;\n\t/** No try left on an app or recovery code: wait, asking again would fail too. */\n\treadonly locked: boolean;\n\treadonly error?: StepUpError | undefined;\n\t/** The last refusal worded for the page, until the next step or the release. */\n\treadonly message?: string | undefined;\n\t/** The seconds a throttled request asks to wait before asking again. */\n\treadonly retryAfter?: number | undefined;\n\t/** A request or a code is in flight. */\n\treadonly pending: boolean;\n\t/** The last request replaced a challenge that was held. */\n\treadonly resent: boolean;\n}\n\nexport type StepUpAction =\n\t| { readonly type: 'start' }\n\t| { readonly type: 'requested'; readonly answer: StepUpRequestAnswer }\n\t| { readonly type: 'submit' }\n\t| { readonly type: 'confirmed'; readonly answer: StepUpConfirmAnswer }\n\t| { readonly type: 'release' };\n\nexport const INITIAL_STEP_UP: StepUpState = {\n\tphase: 'idle',\n\tlocked: false,\n\tpending: false,\n\tresent: false,\n};\n\nfunction requested(\n\tstate: StepUpState,\n\tanswer: StepUpRequestAnswer,\n): StepUpState {\n\tif (!answer.ok) {\n\t\t// A resend refused leaves the code form up, and says why in it.\n\t\treturn {\n\t\t\t...state,\n\t\t\tphase: state.challenge ? 'code' : 'idle',\n\t\t\terror: answer.error,\n\t\t\tmessage: answer.message,\n\t\t\tretryAfter: answer.retryAfter,\n\t\t\tpending: false,\n\t\t\tresent: false,\n\t\t};\n\t}\n\treturn {\n\t\tphase: 'code',\n\t\tvia: answer.via,\n\t\tchallenge: answer.challenge,\n\t\tlocked: false,\n\t\tpending: false,\n\t\tresent: state.challenge !== undefined,\n\t};\n}\n\n/** A refused code. At 0 tries left a mailed code is over (ask again), an app or recovery code is locked (wait). */\nfunction refused(\n\tstate: StepUpState,\n\tanswer: Extract<StepUpConfirmAnswer, { ok: false }>,\n): StepUpState {\n\tconst none = answer.attemptsLeft === 0;\n\tconst over = answer.error === 'expired' || (none && state.via === 'email');\n\tif (over) {\n\t\treturn {\n\t\t\tphase: 'idle',\n\t\t\t...(state.via ? { via: state.via } : {}),\n\t\t\tlocked: false,\n\t\t\terror: 'expired',\n\t\t\tmessage: answer.message,\n\t\t\tpending: false,\n\t\t\tresent: false,\n\t\t};\n\t}\n\treturn {\n\t\t...state,\n\t\tphase: 'code',\n\t\terror: answer.error,\n\t\tmessage: answer.message,\n\t\tretryAfter: undefined,\n\t\tattemptsLeft: answer.attemptsLeft,\n\t\tlocked: answer.locked || none,\n\t\tpending: false,\n\t\tresent: false,\n\t};\n}\n\n/**\n * The step-up's transitions, pure. `start` (a request in flight) forgets the\n * last error but keeps a challenge held, so a refused \"Resend code\" leaves\n * the code form up; a refusal keeps its `message` (and a throttle its\n * `retryAfter`) until the next step; a granted request replaces the challenge; a code accepted\n * spends it; an expired or spent one leaves \"ask again\"; at 0 tries left a\n * mailed code is `expired` and an app or recovery code is `locked`.\n */\nexport function stepUpReducer(\n\tstate: StepUpState,\n\taction: StepUpAction,\n): StepUpState {\n\tswitch (action.type) {\n\t\tcase 'start':\n\t\t\treturn {\n\t\t\t\t...state,\n\t\t\t\tphase: state.challenge ? 'code' : 'requesting',\n\t\t\t\terror: undefined,\n\t\t\t\tmessage: undefined,\n\t\t\t\tretryAfter: undefined,\n\t\t\t\tpending: true,\n\t\t\t\tresent: false,\n\t\t\t};\n\t\tcase 'requested':\n\t\t\treturn requested(state, action.answer);\n\t\tcase 'submit':\n\t\t\treturn {\n\t\t\t\t...state,\n\t\t\t\tphase: 'confirming',\n\t\t\t\terror: undefined,\n\t\t\t\tmessage: undefined,\n\t\t\t\tretryAfter: undefined,\n\t\t\t\tpending: true,\n\t\t\t};\n\t\tcase 'confirmed':\n\t\t\treturn action.answer.ok\n\t\t\t\t? {\n\t\t\t\t\t\tphase: 'done',\n\t\t\t\t\t\t...(state.via ? { via: state.via } : {}),\n\t\t\t\t\t\tlocked: false,\n\t\t\t\t\t\tpending: false,\n\t\t\t\t\t\tresent: false,\n\t\t\t\t\t}\n\t\t\t\t: refused(state, action.answer);\n\t\tcase 'release':\n\t\t\treturn INITIAL_STEP_UP;\n\t}\n}\n",
+    "import type { StepUpVia } from './second-factor';\nimport type { StepUpState } from './step-up';\nimport type { StepUpError } from './step-up-answers';\n\n/**\n * The props of `@nxgt/material`'s `VerificationCode` and `StepUpDialog` that\n * the state decides. The state's `message` is not one: the dialog words its\n * own texts from `error`, `attemptsLeft`, `locked` and `retryAfter`. The callbacks (`onSubmit`, `onResend`) are the app's.\n */\nexport interface StepUpProps {\n\treadonly via?: StepUpVia;\n\treadonly attemptsLeft?: number;\n\treadonly locked: boolean;\n\treadonly error?: StepUpError;\n\t/** The seconds to wait when `error` is `throttled` and the API said how long. */\n\treadonly retryAfter?: number;\n\treadonly pending: boolean;\n\treadonly resent: boolean;\n}\n\n/** The state as the dialog's props: `{ ...stepUpProps(state), onSubmit, onResend }`. */\nexport function stepUpProps(state: StepUpState): StepUpProps {\n\treturn {\n\t\t...(state.via ? { via: state.via } : {}),\n\t\t...(state.attemptsLeft === undefined\n\t\t\t? {}\n\t\t\t: { attemptsLeft: state.attemptsLeft }),\n\t\tlocked: state.locked,\n\t\t...(state.error ? { error: state.error } : {}),\n\t\t...(state.retryAfter === undefined ? {} : { retryAfter: state.retryAfter }),\n\t\tpending: state.pending,\n\t\tresent: state.resent,\n\t};\n}\n"
+  ],
+  "mappings": ";AACO,IAAM,QAAO;AAGpB,IAAM,OAAO;AAaN,SAAS,SAAQ,CAAC,OAA0C;AAAA,EAClE,IAAI,CAAC,SAAS,MAAM,SAAS;AAAA,IAAM,OAAO;AAAA,EAC1C,IAAI,CAAC,MAAM,WAAW,GAAG,KAAK,MAAM,WAAW,IAAI;AAAA,IAAG,OAAO;AAAA,EAE7D,IAAI,gBAAgB,KAAK,KAAK;AAAA,IAAG,OAAO;AAAA,EACxC,IAAI;AAAA,IACH,MAAM,MAAM,IAAI,IAAI,OAAO,IAAI;AAAA,IAC/B,MAAM,OAAO,GAAG,IAAI,WAAW,IAAI,SAAS,IAAI;AAAA,IAEhD,IAAI,IAAI,WAAW,QAAQ,KAAK,WAAW,IAAI;AAAA,MAAG,OAAO;AAAA,IACzD,OAAO;AAAA,IACN,MAAM;AAAA,IACP,OAAO;AAAA;AAAA;;;ACtBF,SAAS,QAAQ,CACvB;AAAA,EAEC;AAAA,EACA,QAAQ;AAAA,GAEA;AAAA,EACT,IAAI,UAAS,IAAI,MAAM,QAAS,CAAC,SAAS,OAAO,KAAK,IAAI,GAAI;AAAA,IAC7D,MAAM,QAAQ,QAAQ,OAAO,KAAK,QAAQ,YAAY,IAAI;AAAA,IAC1D,MAAM,IAAI,UACT,GAAG,oCAAoC,QAAQ,KAAK,iEAAiE,KAAK,UAAU,KAAK,IAC1I;AAAA,EACD;AAAA,EACA,OAAO;AAAA;;;ACVD,IAAM,iBAA6B;AAAA,EACzC,QAAQ;AAAA,EACR,cAAc;AACf;AAEA,SAAS,QAAQ,CAChB,MACA,MACA,OACS;AAAA,EACT,MAAM,SAAS,IAAI,gBAAgB,KAAK;AAAA,EACxC,MAAM,SAAS,UAAS,IAAI;AAAA,EAC5B,IAAI,WAAW;AAAA,IAAM,OAAO,IAAI,QAAQ,MAAM;AAAA,EAC9C,MAAM,SAAS,OAAO,SAAS;AAAA,EAC/B,OAAO,SAAS,GAAG,QAAQ,WAAW;AAAA;AAahC,SAAS,WAAU,CACzB,MACA,UAGI,CAAC,GACI;AAAA,EACT,MAAM,OACL,QAAQ,SAAS,YACd,eAAc,SACd,SAAS,QAAQ,MAAM,EAAE,OAAO,6BAA6B,CAAC;AAAA,EAClE,OAAO,SAAS,MAAM,MAAM,QAAQ,KAAK;AAAA;AAInC,SAAS,iBAAgB,CAC/B,MACA,OAAe,eAAc,cACpB;AAAA,EACT,OAAO,SAAS,MAAM,IAAI;AAAA;;ACvDpB,IAAM,aAAoB;;AC0C1B,IAAM,mBAA+B;AAAA,EAC3C,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AACT;AAEA,SAAS,SAAS,CACjB,OACA,QACc;AAAA,EACd,IAAI,CAAC,OAAO,IAAI;AAAA,IAEf,OAAO;AAAA,SACH;AAAA,MACH,OAAO,MAAM,YAAY,SAAS;AAAA,MAClC,OAAO,OAAO;AAAA,MACd,SAAS,OAAO;AAAA,MAChB,YAAY,OAAO;AAAA,MACnB,SAAS;AAAA,MACT,QAAQ;AAAA,IACT;AAAA,EACD;AAAA,EACA,OAAO;AAAA,IACN,OAAO;AAAA,IACP,KAAK,OAAO;AAAA,IACZ,WAAW,OAAO;AAAA,IAClB,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,QAAQ,MAAM,cAAc;AAAA,EAC7B;AAAA;AAID,SAAS,OAAO,CACf,OACA,QACc;AAAA,EACd,MAAM,OAAO,OAAO,iBAAiB;AAAA,EACrC,MAAM,OAAO,OAAO,UAAU,aAAc,QAAQ,MAAM,QAAQ;AAAA,EAClE,IAAI,MAAM;AAAA,IACT,OAAO;AAAA,MACN,OAAO;AAAA,SACH,MAAM,MAAM,EAAE,KAAK,MAAM,IAAI,IAAI,CAAC;AAAA,MACtC,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,SAAS,OAAO;AAAA,MAChB,SAAS;AAAA,MACT,QAAQ;AAAA,IACT;AAAA,EACD;AAAA,EACA,OAAO;AAAA,OACH;AAAA,IACH,OAAO;AAAA,IACP,OAAO,OAAO;AAAA,IACd,SAAS,OAAO;AAAA,IAChB,YAAY;AAAA,IACZ,cAAc,OAAO;AAAA,IACrB,QAAQ,OAAO,UAAU;AAAA,IACzB,SAAS;AAAA,IACT,QAAQ;AAAA,EACT;AAAA;AAWM,SAAS,cAAa,CAC5B,OACA,QACc;AAAA,EACd,QAAQ,OAAO;AAAA,SACT;AAAA,MACJ,OAAO;AAAA,WACH;AAAA,QACH,OAAO,MAAM,YAAY,SAAS;AAAA,QAClC,OAAO;AAAA,QACP,SAAS;AAAA,QACT,YAAY;AAAA,QACZ,SAAS;AAAA,QACT,QAAQ;AAAA,MACT;AAAA,SACI;AAAA,MACJ,OAAO,UAAU,OAAO,OAAO,MAAM;AAAA,SACjC;AAAA,MACJ,OAAO;AAAA,WACH;AAAA,QACH,OAAO;AAAA,QACP,OAAO;AAAA,QACP,SAAS;AAAA,QACT,YAAY;AAAA,QACZ,SAAS;AAAA,MACV;AAAA,SACI;AAAA,MACJ,OAAO,OAAO,OAAO,KAClB;AAAA,QACA,OAAO;AAAA,WACH,MAAM,MAAM,EAAE,KAAK,MAAM,IAAI,IAAI,CAAC;AAAA,QACtC,QAAQ;AAAA,QACR,SAAS;AAAA,QACT,QAAQ;AAAA,MACT,IACC,QAAQ,OAAO,OAAO,MAAM;AAAA,SAC3B;AAAA,MACJ,OAAO;AAAA;AAAA;;ACnIH,SAAS,YAAW,CAAC,OAAiC;AAAA,EAC5D,OAAO;AAAA,OACF,MAAM,MAAM,EAAE,KAAK,MAAM,IAAI,IAAI,CAAC;AAAA,OAClC,MAAM,iBAAiB,YACxB,CAAC,IACD,EAAE,cAAc,MAAM,aAAa;AAAA,IACtC,QAAQ,MAAM;AAAA,OACV,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;AAAA,OACxC,MAAM,eAAe,YAAY,CAAC,IAAI,EAAE,YAAY,MAAM,WAAW;AAAA,IACzE,SAAS,MAAM;AAAA,IACf,QAAQ,MAAM;AAAA,EACf;AAAA;",
+  "debugId": "01582ABF6CEE43FB64756E2164756E21",
+  "names": []
+}

package/dist/chunks/index-c3k47yw7.js

@@ -0,0 +1,124 @@
+// src/errors/api-error.ts
+var isNamed = (error, name) => error instanceof Error && error.name === name;
+function isApiErrorLike2(error) {
+  return isNamed(error, "ApiError") && Array.isArray(error.errors) && typeof error.status === "number";
+}
+function waitMinutes2(extensions) {
+  const minutes = extensions?.params?.minutes ?? extensions?.minutes;
+  if (minutes !== undefined)
+    return Math.max(1, Number(minutes) || 1);
+  const seconds = extensions?.params?.retryAfter ?? extensions?.retryAfter;
+  return Math.max(1, Math.ceil(Number(seconds) / 60) || 1);
+}
+var MAX_RETRY_AFTER = 86400;
+function secondsOf(value) {
+  const seconds = typeof value === "string" && /^\d+(\.\d+)?$/.test(value.trim()) ? Number(value.trim()) : value;
+  return typeof seconds === "number" && Number.isFinite(seconds) && seconds >= 0 ? Math.min(MAX_RETRY_AFTER, Math.ceil(seconds)) + 0 : undefined;
+}
+function retryAfterOf(error) {
+  const extensions = error.errors[0]?.extensions;
+  return secondsOf(extensions?.params?.retryAfter) ?? secondsOf(extensions?.retryAfter);
+}
+function attemptsLeftOf2(error) {
+  const extensions = error.errors[0]?.extensions;
+  for (const value of [
+    extensions?.attemptsLeft,
+    extensions?.params?.attemptsLeft
+  ]) {
+    if (typeof value === "number" && Number.isInteger(value) && value >= 0) {
+      return value;
+    }
+  }
+  return;
+}
+function valuesOf(extensions) {
+  if (!extensions)
+    return;
+  return extensions.params ? { ...extensions, ...extensions.params } : extensions;
+}
+var isStatusError = (error) => isNamed(error, "ApiStatusError") && typeof error.status === "number";
+var isUnavailableError = (error) => isNamed(error, "ApiUnavailableError") && typeof error.reason === "string";
+
+// src/errors/route-error.ts
+import { data } from "react-router";
+
+// src/errors/request-id.ts
+var REQUEST_ID_HEADER2 = "x-request-id";
+function requestIdOf2(response) {
+  return response.headers.get(REQUEST_ID_HEADER2) || undefined;
+}
+
+// src/errors/route-error.ts
+var ROUTED = new Set([401, 403, 404, 503]);
+function routeError2(error, { statuses = ROUTED } = {}) {
+  if (isApiErrorLike2(error)) {
+    const { requestId } = error;
+    if (statuses.has(error.status)) {
+      return data({ code: error.code, message: error.message, requestId }, { status: error.status });
+    }
+    return requestId ? data({ requestId }, { status: 500 }) : error;
+  }
+  if (error instanceof Response && statuses.has(error.status)) {
+    const requestId = requestIdOf2(error);
+    if (requestId) {
+      return data({ requestId }, { status: error.status });
+    }
+  }
+  return error;
+}
+function errorRequestId2(error) {
+  if (typeof error !== "object" || error === null)
+    return;
+  const { data: body } = error;
+  if (typeof body !== "object" || body === null)
+    return;
+  const { requestId } = body;
+  return typeof requestId === "string" && requestId ? requestId : undefined;
+}
+
+// src/errors/page-path.ts
+function nextOf2(url) {
+  const { pathname, searchParams } = new URL(url);
+  const trimmed = pathname.endsWith("/_.data") ? pathname.slice(0, -"_.data".length) : pathname.replace(/\.data$/, "");
+  const path = trimmed.replace(/^\/{2,}/, "/");
+  const params = new URLSearchParams(searchParams);
+  params.delete("_routes");
+  for (const value of params.getAll("index")) {
+    if (!value)
+      params.delete("index", value);
+  }
+  const search = params.toString();
+  return search ? `${path}?${search}` : path;
+}
+
+// src/errors/same-site.ts
+import { data as data2 } from "react-router";
+function siteCheck(origin) {
+  return (request) => {
+    const set = typeof origin === "function" ? origin() : origin;
+    const own = set ?? new URL(request.url).origin;
+    const from = request.headers.get("origin");
+    const site = request.headers.get("sec-fetch-site");
+    if (from && from !== own || site && site !== "same-origin" && site !== "none") {
+      throw data2("Cross-site request refused", { status: 403 });
+    }
+  };
+}
+var SITE_CHECK = Symbol.for("@alxia/react-router:site-check@1");
+function rememberSiteCheck(actions, check) {
+  Object.defineProperty(actions, SITE_CHECK, {
+    value: check,
+    enumerable: true,
+    writable: false
+  });
+}
+var hasSiteCheck = (actions) => typeof actions[SITE_CHECK] === "function";
+function refuseCrossSite(actions, request) {
+  const check = actions[SITE_CHECK];
+  (typeof check === "function" ? check : siteCheck())(request);
+}
+
+export { isApiErrorLike2, waitMinutes2, retryAfterOf, attemptsLeftOf2, valuesOf, isStatusError, isUnavailableError, REQUEST_ID_HEADER2, requestIdOf2, routeError2, errorRequestId2, nextOf2, siteCheck, rememberSiteCheck, hasSiteCheck, refuseCrossSite };
+
+//# debugId=6C1CCB39B164FD8364756E2164756E21
+//# sourceMappingURL=index-c3k47yw7.js.map

package/dist/chunks/index-c3k47yw7.js.map

@@ -0,0 +1,14 @@
+{
+  "version": 3,
+  "sources": ["../src/errors/api-error.ts", "../src/errors/route-error.ts", "../src/errors/request-id.ts", "../src/errors/page-path.ts", "../src/errors/same-site.ts"],
+  "sourcesContent": [
+    "/**\n * The shape of an API's refusal, as `@nxgt/graphql-client`'s `ApiError`\n * carries it, declared structurally: `/errors` never imports the client, so\n * an app needs it only if it calls the API through it. `api-error.spec.ts`\n * holds the two in step.\n */\n\n/** One refused input field: `extensions.fields` of a validation refusal. */\nexport interface ApiFieldErrorLike {\n\treadonly path: string;\n\treadonly code: string;\n\treadonly message: string;\n\t/** The values the field's message interpolates. */\n\treadonly params?: Readonly<Record<string, unknown>>;\n}\n\n/** The values a message interpolates; a throttle's wait is `minutes` or `retryAfter`. */\nexport interface ApiErrorParamsLike {\n\treadonly minutes?: unknown;\n\treadonly retryAfter?: unknown;\n\treadonly attemptsLeft?: unknown;\n\treadonly [key: string]: unknown;\n}\n\n/**\n * One GraphQL error's `extensions`. `code` is the API's own\n * `<module>.errors.<slug>`; the rest is what its messages name.\n */\nexport interface ApiErrorExtensionsLike {\n\treadonly code?: string;\n\t/** The values the message interpolates, when the API sends them. */\n\treadonly params?: ApiErrorParamsLike;\n\t/** A validation refusal: every field at fault, by input path. */\n\treadonly fields?: readonly ApiFieldErrorLike[];\n\t/** Any other refusal about one input field, by its path. */\n\treadonly field?: string;\n\t/** A throttle's wait, in minutes (`waitMinutes` coerces a string). */\n\treadonly minutes?: unknown;\n\t/** A throttle's wait, in seconds. */\n\treadonly retryAfter?: unknown;\n\t/** The tries a refused code leaves, as `@nxgt/janus` counts them. */\n\treadonly attemptsLeft?: unknown;\n\treadonly [key: string]: unknown;\n}\n\n/** One error of a response's `errors`. */\nexport interface ApiErrorEntryLike {\n\treadonly message: string;\n\treadonly extensions?: ApiErrorExtensionsLike;\n}\n\n/** A refusal read from a GraphQL API: what `ApiError` has, and the request id. */\nexport interface ApiErrorLike extends Error {\n\treadonly errors: readonly ApiErrorEntryLike[];\n\t/** The first error's `extensions.code`. */\n\treadonly code: string | undefined;\n\t/** The HTTP status to answer with. */\n\treadonly status: number;\n\t/** The id the API logged the request under, when the caller kept it. */\n\treadonly requestId?: string;\n}\n\n/** Whether `error` is an `Error` of this `name`: the client's errors are told by it, never `instanceof`. */\nexport const isNamed = (error: unknown, name: string): error is Error =>\n\terror instanceof Error && error.name === name;\n\n/**\n * Whether `error` is an `ApiError` of `@nxgt/graphql-client`, by the test\n * that client's `isApiError` makes (an `Error` named `ApiError` with an\n * `errors` array), plus a numeric `status`, which `ApiErrorLike` promises.\n * It holds across two copies of the client.\n */\nexport function isApiErrorLike(error: unknown): error is ApiErrorLike {\n\treturn (\n\t\tisNamed(error, 'ApiError') &&\n\t\tArray.isArray((error as { errors?: unknown }).errors) &&\n\t\ttypeof (error as { status?: unknown }).status === 'number'\n\t);\n}\n\n/**\n * The minutes a wait lasts, as the API words it: `minutes` (at least one, in\n * `extensions.params` or beside it), else the `retryAfter` seconds rounded\n * up, else one.\n */\nexport function waitMinutes(\n\textensions: ApiErrorExtensionsLike | undefined,\n): number {\n\tconst minutes = extensions?.params?.minutes ?? extensions?.minutes;\n\tif (minutes !== undefined) return Math.max(1, Number(minutes) || 1);\n\tconst seconds = extensions?.params?.retryAfter ?? extensions?.retryAfter;\n\treturn Math.max(1, Math.ceil(Number(seconds) / 60) || 1);\n}\n\nconst MAX_RETRY_AFTER = 86_400;\n\n/** A wait in seconds from one value: a finite number from 0, or a decimal string. */\nfunction secondsOf(value: unknown): number | undefined {\n\tconst seconds =\n\t\ttypeof value === 'string' && /^\\d+(\\.\\d+)?$/.test(value.trim())\n\t\t\t? Number(value.trim())\n\t\t\t: value;\n\treturn typeof seconds === 'number' && Number.isFinite(seconds) && seconds >= 0\n\t\t? Math.min(MAX_RETRY_AFTER, Math.ceil(seconds)) + 0\n\t\t: undefined;\n}\n\n/**\n * The seconds a throttle asks to wait: `retryAfter` of the first error's\n * `extensions.params`, else (when that is unusable) of its `extensions`.\n * Only a finite number from 0, or a decimal string, counts; it is rounded up\n * and held at a day (86 400), and `-0` is 0. `undefined` when the API sent\n * none usable. Internal: `/session` words it as a typed `retryAfter`.\n */\nexport function retryAfterOf(error: ApiErrorLike): number | undefined {\n\tconst extensions = error.errors[0]?.extensions;\n\treturn (\n\t\tsecondsOf(extensions?.params?.retryAfter) ??\n\t\tsecondsOf(extensions?.retryAfter)\n\t);\n}\n\n/**\n * The tries a refused code leaves, as `@nxgt/janus` counts them:\n * `extensions.attemptsLeft` of the first error, else the same key in its\n * `params`. A whole number from 0 up; `undefined` when the API sent none or\n * something that is not a count.\n */\nexport function attemptsLeftOf(error: ApiErrorLike): number | undefined {\n\tconst extensions = error.errors[0]?.extensions;\n\tfor (const value of [\n\t\textensions?.attemptsLeft,\n\t\textensions?.params?.attemptsLeft,\n\t]) {\n\t\tif (typeof value === 'number' && Number.isInteger(value) && value >= 0) {\n\t\t\treturn value;\n\t\t}\n\t}\n\treturn undefined;\n}\n\n/**\n * The values a message names: `extensions.params` over the extensions\n * themselves, where older errors and the extras of a few sit.\n */\nexport function valuesOf(\n\textensions: ApiErrorExtensionsLike | undefined,\n): Record<string, unknown> | undefined {\n\tif (!extensions) return undefined;\n\treturn extensions.params\n\t\t? { ...extensions, ...extensions.params }\n\t\t: extensions;\n}\n\n/** `@nxgt/graphql-client`'s `ApiStatusError`, as far as the failure reads it. */\nexport interface StatusErrorLike extends Error {\n\tstatus: number;\n\tstatusText?: string | undefined;\n\tbody?: unknown;\n}\n\n/** `@nxgt/graphql-client`'s `ApiUnavailableError`, as far as the failure reads it. */\nexport interface UnavailableErrorLike extends Error {\n\treason: string;\n}\n\nexport const isStatusError = (error: unknown): error is StatusErrorLike =>\n\tisNamed(error, 'ApiStatusError') &&\n\ttypeof (error as { status?: unknown }).status === 'number';\n\nexport const isUnavailableError = (\n\terror: unknown,\n): error is UnavailableErrorLike =>\n\tisNamed(error, 'ApiUnavailableError') &&\n\ttypeof (error as { reason?: unknown }).reason === 'string';\n",
+    "import { data } from 'react-router';\nimport { isApiErrorLike } from './api-error';\nimport { requestIdOf } from './request-id';\n\n/** The statuses an error page words: unauthenticated, forbidden, missing, unavailable. */\nconst ROUTED: ReadonlySet<number> = new Set([401, 403, 404, 503]);\n\n/**\n * What a route error of the API carries to the error page: the API's code\n * and message when it gave a code, and the `X-Request-Id` of the call as the\n * support reference (`errorRequestId`).\n */\nexport type RouteErrorData = {\n\tcode?: string | undefined;\n\tmessage?: string | undefined;\n\trequestId?: string | undefined;\n};\n\nexport interface RouteErrorOptions {\n\t/** The statuses that become a route error of their own; 401, 403, 404 and 503 by default. */\n\tstatuses?: ReadonlySet<number>;\n}\n\n/**\n * What a loader throws for an error from the API: an `ApiError` whose\n * status is routed (401, 403, 404 or 503) becomes a route error response of\n * that status, which the root `ErrorBoundary` renders as its page, with the\n * call's request id when the API gave one. A thrown routed `Response` that\n * carries a request id becomes one too (a bare `Response` hands the browser\n * its body only). Any other `ApiError` that has a request id becomes a 500\n * with just that id, so the generic error page can show it. Anything else\n * is returned as it is.\n */\nexport function routeError(\n\terror: unknown,\n\t{ statuses = ROUTED }: RouteErrorOptions = {},\n): unknown {\n\tif (isApiErrorLike(error)) {\n\t\tconst { requestId } = error;\n\t\tif (statuses.has(error.status)) {\n\t\t\treturn data<RouteErrorData>(\n\t\t\t\t{ code: error.code, message: error.message, requestId },\n\t\t\t\t{ status: error.status },\n\t\t\t);\n\t\t}\n\t\treturn requestId\n\t\t\t? data<RouteErrorData>({ requestId }, { status: 500 })\n\t\t\t: error;\n\t}\n\tif (error instanceof Response && statuses.has(error.status)) {\n\t\tconst requestId = requestIdOf(error);\n\t\tif (requestId) {\n\t\t\treturn data<RouteErrorData>({ requestId }, { status: error.status });\n\t\t}\n\t}\n\treturn error;\n}\n\n/**\n * The support reference an error page shows: the API's `X-Request-Id` a\n * route error carries (`routeError`), if it carries one.\n */\nexport function errorRequestId(error: unknown): string | undefined {\n\tif (typeof error !== 'object' || error === null) return undefined;\n\tconst { data: body } = error as { data?: unknown };\n\tif (typeof body !== 'object' || body === null) return undefined;\n\tconst { requestId } = body as { requestId?: unknown };\n\treturn typeof requestId === 'string' && requestId ? requestId : undefined;\n}\n",
+    "/** The header an API echoes on every response: the id its logs carry. */\nexport const REQUEST_ID_HEADER = 'x-request-id';\n\n/** The request id a response carries, if the API sent one. */\nexport function requestIdOf(response: Response): string | undefined {\n\treturn response.headers.get(REQUEST_ID_HEADER) || undefined;\n}\n",
+    "/**\n * The page a request is for, as `next` carries it back after sign-in: its\n * path and search, without React Router's single-fetch details. A client\n * navigation's `request.url` is `/todos/demo/list.data?q=a&_routes=…`\n * (`/_.data` for `/`, `?index` for an index action), as the server\n * runtime's own `normalizeUrl` strips them.\n */\nexport function nextOf(url: string): string {\n\tconst { pathname, searchParams } = new URL(url);\n\tconst trimmed = pathname.endsWith('/_.data')\n\t\t? pathname.slice(0, -'_.data'.length)\n\t\t: pathname.replace(/\\.data$/, '');\n\t// `new URL('http://h/\\\\evil.com')` has the path `//evil.com`: never let a\n\t// `next` start with two slashes, which a redirect reads as another site.\n\tconst path = trimmed.replace(/^\\/{2,}/, '/');\n\tconst params = new URLSearchParams(searchParams);\n\tparams.delete('_routes');\n\t// An empty `index` names the index route; a valued one is the page's own.\n\tfor (const value of params.getAll('index')) {\n\t\tif (!value) params.delete('index', value);\n\t}\n\tconst search = params.toString();\n\treturn search ? `${path}?${search}` : path;\n}\n",
+    "import { data } from 'react-router';\n\n/** Refuses a request from another site with a 403; reads headers only. */\nexport type SiteCheck = (request: Request) => void;\n\n/**\n * The same-site rule of `readJson`: an `Origin` that is not the app's own, or\n * a `Sec-Fetch-Site` that is neither `same-origin` nor `none`, is a 403.\n * `origin` is the app's configured origin (or a getter), else the request's.\n */\nexport function siteCheck(\n\torigin?: string | (() => string | undefined) | undefined,\n): SiteCheck {\n\treturn (request) => {\n\t\tconst set = typeof origin === 'function' ? origin() : origin;\n\t\tconst own = set ?? new URL(request.url).origin;\n\t\tconst from = request.headers.get('origin');\n\t\tconst site = request.headers.get('sec-fetch-site');\n\t\tif (\n\t\t\t(from && from !== own) ||\n\t\t\t(site && site !== 'same-origin' && site !== 'none')\n\t\t) {\n\t\t\tthrow data('Cross-site request refused', { status: 403 });\n\t\t}\n\t};\n}\n\n/**\n * Where a `jsonActions` instance keeps its site check: an enumerable property\n * under a registered symbol, so it survives `{ ...json }` and a second copy of\n * the package. Not public.\n */\nexport const SITE_CHECK = Symbol.for('@alxia/react-router:site-check@1');\n\n/** Puts the check on a `jsonActions` instance. */\nexport function rememberSiteCheck(actions: object, check: SiteCheck): void {\n\tObject.defineProperty(actions, SITE_CHECK, {\n\t\tvalue: check,\n\t\tenumerable: true,\n\t\twritable: false,\n\t});\n}\n\n/** Whether `actions` carries a site check, as every `jsonActions()` instance does. */\nexport const hasSiteCheck = (actions: object): boolean =>\n\ttypeof (actions as Record<symbol, unknown>)[SITE_CHECK] === 'function';\n\n/**\n * Refuses a cross-site request with the rule of the `jsonActions` instance\n * (its configured origin, read at each request); an object without a check\n * gets the request's own origin. It reads headers only, never the body.\n */\nexport function refuseCrossSite(actions: object, request: Request): void {\n\tconst check = (actions as Record<symbol, unknown>)[SITE_CHECK];\n\t(typeof check === 'function' ? (check as SiteCheck) : siteCheck())(request);\n}\n"
+  ],
+  "mappings": ";AA+DO,IAAM,UAAU,CAAC,OAAgB,SACvC,iBAAiB,SAAS,MAAM,SAAS;AAQnC,SAAS,eAAc,CAAC,OAAuC;AAAA,EACrE,OACC,QAAQ,OAAO,UAAU,KACzB,MAAM,QAAS,MAA+B,MAAM,KACpD,OAAQ,MAA+B,WAAW;AAAA;AAS7C,SAAS,YAAW,CAC1B,YACS;AAAA,EACT,MAAM,UAAU,YAAY,QAAQ,WAAW,YAAY;AAAA,EAC3D,IAAI,YAAY;AAAA,IAAW,OAAO,KAAK,IAAI,GAAG,OAAO,OAAO,KAAK,CAAC;AAAA,EAClE,MAAM,UAAU,YAAY,QAAQ,cAAc,YAAY;AAAA,EAC9D,OAAO,KAAK,IAAI,GAAG,KAAK,KAAK,OAAO,OAAO,IAAI,EAAE,KAAK,CAAC;AAAA;AAGxD,IAAM,kBAAkB;AAGxB,SAAS,SAAS,CAAC,OAAoC;AAAA,EACtD,MAAM,UACL,OAAO,UAAU,YAAY,gBAAgB,KAAK,MAAM,KAAK,CAAC,IAC3D,OAAO,MAAM,KAAK,CAAC,IACnB;AAAA,EACJ,OAAO,OAAO,YAAY,YAAY,OAAO,SAAS,OAAO,KAAK,WAAW,IAC1E,KAAK,IAAI,iBAAiB,KAAK,KAAK,OAAO,CAAC,IAAI,IAChD;AAAA;AAUG,SAAS,YAAY,CAAC,OAAyC;AAAA,EACrE,MAAM,aAAa,MAAM,OAAO,IAAI;AAAA,EACpC,OACC,UAAU,YAAY,QAAQ,UAAU,KACxC,UAAU,YAAY,UAAU;AAAA;AAU3B,SAAS,eAAc,CAAC,OAAyC;AAAA,EACvE,MAAM,aAAa,MAAM,OAAO,IAAI;AAAA,EACpC,WAAW,SAAS;AAAA,IACnB,YAAY;AAAA,IACZ,YAAY,QAAQ;AAAA,EACrB,GAAG;AAAA,IACF,IAAI,OAAO,UAAU,YAAY,OAAO,UAAU,KAAK,KAAK,SAAS,GAAG;AAAA,MACvE,OAAO;AAAA,IACR;AAAA,EACD;AAAA,EACA;AAAA;AAOM,SAAS,QAAQ,CACvB,YACsC;AAAA,EACtC,IAAI,CAAC;AAAA,IAAY;AAAA,EACjB,OAAO,WAAW,SACf,KAAK,eAAe,WAAW,OAAO,IACtC;AAAA;AAeG,IAAM,gBAAgB,CAAC,UAC7B,QAAQ,OAAO,gBAAgB,KAC/B,OAAQ,MAA+B,WAAW;AAE5C,IAAM,qBAAqB,CACjC,UAEA,QAAQ,OAAO,qBAAqB,KACpC,OAAQ,MAA+B,WAAW;;;AC9KnD;;;ACCO,IAAM,qBAAoB;AAG1B,SAAS,YAAW,CAAC,UAAwC;AAAA,EACnE,OAAO,SAAS,QAAQ,IAAI,kBAAiB,KAAK;AAAA;;;ADAnD,IAAM,SAA8B,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,GAAG,CAAC;AA4BzD,SAAS,WAAU,CACzB,SACE,WAAW,WAA8B,CAAC,GAClC;AAAA,EACV,IAAI,gBAAe,KAAK,GAAG;AAAA,IAC1B,QAAQ,cAAc;AAAA,IACtB,IAAI,SAAS,IAAI,MAAM,MAAM,GAAG;AAAA,MAC/B,OAAO,KACN,EAAE,MAAM,MAAM,MAAM,SAAS,MAAM,SAAS,UAAU,GACtD,EAAE,QAAQ,MAAM,OAAO,CACxB;AAAA,IACD;AAAA,IACA,OAAO,YACJ,KAAqB,EAAE,UAAU,GAAG,EAAE,QAAQ,IAAI,CAAC,IACnD;AAAA,EACJ;AAAA,EACA,IAAI,iBAAiB,YAAY,SAAS,IAAI,MAAM,MAAM,GAAG;AAAA,IAC5D,MAAM,YAAY,aAAY,KAAK;AAAA,IACnC,IAAI,WAAW;AAAA,MACd,OAAO,KAAqB,EAAE,UAAU,GAAG,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IACpE;AAAA,EACD;AAAA,EACA,OAAO;AAAA;AAOD,SAAS,eAAc,CAAC,OAAoC;AAAA,EAClE,IAAI,OAAO,UAAU,YAAY,UAAU;AAAA,IAAM;AAAA,EACjD,QAAQ,MAAM,SAAS;AAAA,EACvB,IAAI,OAAO,SAAS,YAAY,SAAS;AAAA,IAAM;AAAA,EAC/C,QAAQ,cAAc;AAAA,EACtB,OAAO,OAAO,cAAc,YAAY,YAAY,YAAY;AAAA;;;AE5D1D,SAAS,OAAM,CAAC,KAAqB;AAAA,EAC3C,QAAQ,UAAU,iBAAiB,IAAI,IAAI,GAAG;AAAA,EAC9C,MAAM,UAAU,SAAS,SAAS,SAAS,IACxC,SAAS,MAAM,GAAG,CAAC,SAAS,MAAM,IAClC,SAAS,QAAQ,WAAW,EAAE;AAAA,EAGjC,MAAM,OAAO,QAAQ,QAAQ,WAAW,GAAG;AAAA,EAC3C,MAAM,SAAS,IAAI,gBAAgB,YAAY;AAAA,EAC/C,OAAO,OAAO,SAAS;AAAA,EAEvB,WAAW,SAAS,OAAO,OAAO,OAAO,GAAG;AAAA,IAC3C,IAAI,CAAC;AAAA,MAAO,OAAO,OAAO,SAAS,KAAK;AAAA,EACzC;AAAA,EACA,MAAM,SAAS,OAAO,SAAS;AAAA,EAC/B,OAAO,SAAS,GAAG,QAAQ,WAAW;AAAA;;;ACtBvC,iBAAS;AAUF,SAAS,SAAS,CACxB,QACY;AAAA,EACZ,OAAO,CAAC,YAAY;AAAA,IACnB,MAAM,MAAM,OAAO,WAAW,aAAa,OAAO,IAAI;AAAA,IACtD,MAAM,MAAM,OAAO,IAAI,IAAI,QAAQ,GAAG,EAAE;AAAA,IACxC,MAAM,OAAO,QAAQ,QAAQ,IAAI,QAAQ;AAAA,IACzC,MAAM,OAAO,QAAQ,QAAQ,IAAI,gBAAgB;AAAA,IACjD,IACE,QAAQ,SAAS,OACjB,QAAQ,SAAS,iBAAiB,SAAS,QAC3C;AAAA,MACD,MAAM,MAAK,8BAA8B,EAAE,QAAQ,IAAI,CAAC;AAAA,IACzD;AAAA;AAAA;AASK,IAAM,aAAa,OAAO,IAAI,kCAAkC;AAGhE,SAAS,iBAAiB,CAAC,SAAiB,OAAwB;AAAA,EAC1E,OAAO,eAAe,SAAS,YAAY;AAAA,IAC1C,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,UAAU;AAAA,EACX,CAAC;AAAA;AAIK,IAAM,eAAe,CAAC,YAC5B,OAAQ,QAAoC,gBAAgB;AAOtD,SAAS,eAAe,CAAC,SAAiB,SAAwB;AAAA,EACxE,MAAM,QAAS,QAAoC;AAAA,GAClD,OAAO,UAAU,aAAc,QAAsB,UAAU,GAAG,OAAO;AAAA;",
+  "debugId": "6C1CCB39B164FD8364756E2164756E21",
+  "names": []
+}

package/dist/errors/api-error.d.ts

@@ -16,6 +16,7 @@ export interface ApiFieldErrorLike {
 export interface ApiErrorParamsLike {
     readonly minutes?: unknown;
     readonly retryAfter?: unknown;
+    readonly attemptsLeft?: unknown;
     readonly [key: string]: unknown;
 }
 /**
@@ -34,6 +35,8 @@ export interface ApiErrorExtensionsLike {
     readonly minutes?: unknown;
     /** A throttle's wait, in seconds. */
     readonly retryAfter?: unknown;
+    /** The tries a refused code leaves, as `@nxgt/janus` counts them. */
+    readonly attemptsLeft?: unknown;
     readonly [key: string]: unknown;
 }
 /** One error of a response's `errors`. */
@@ -66,6 +69,21 @@ export declare function isApiErrorLike(error: unknown): error is ApiErrorLike;
  * up, else one.
  */
 export declare function waitMinutes(extensions: ApiErrorExtensionsLike | undefined): number;
+/**
+ * The seconds a throttle asks to wait: `retryAfter` of the first error's
+ * `extensions.params`, else (when that is unusable) of its `extensions`.
+ * Only a finite number from 0, or a decimal string, counts; it is rounded up
+ * and held at a day (86 400), and `-0` is 0. `undefined` when the API sent
+ * none usable. Internal: `/session` words it as a typed `retryAfter`.
+ */
+export declare function retryAfterOf(error: ApiErrorLike): number | undefined;
+/**
+ * The tries a refused code leaves, as `@nxgt/janus` counts them:
+ * `extensions.attemptsLeft` of the first error, else the same key in its
+ * `params`. A whole number from 0 up; `undefined` when the API sent none or
+ * something that is not a count.
+ */
+export declare function attemptsLeftOf(error: ApiErrorLike): number | undefined;
 /**
  * The values a message names: `extensions.params` over the extensions
  * themselves, where older errors and the extras of a few sit.

package/dist/errors/api-error.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-error.d.ts","sourceRoot":"","sources":["../../src/errors/api-error.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,4EAA4E;AAC5E,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mDAAmD;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACpD;AAED,yFAAyF;AACzF,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAChC;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;IACrC,iEAAiE;IACjE,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC/C,4DAA4D;IAC5D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,qCAAqC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAChC;AAED,0CAA0C;AAC1C,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,sBAAsB,CAAC;CAC7C;AAED,kFAAkF;AAClF,MAAM,WAAW,YAAa,SAAQ,KAAK;IAC1C,QAAQ,CAAC,MAAM,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC9C,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,sCAAsC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,4GAA4G;AAC5G,eAAO,MAAM,OAAO,GAAI,OAAO,OAAO,EAAE,MAAM,MAAM,KAAG,KAAK,IAAI,KAClB,CAAC;AAE/C;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAMpE;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAC1B,UAAU,EAAE,sBAAsB,GAAG,SAAS,GAC5C,MAAM,CAKR;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CACvB,UAAU,EAAE,sBAAsB,GAAG,SAAS,GAC5C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAKrC;AAED,iFAAiF;AACjF,MAAM,WAAW,eAAgB,SAAQ,KAAK;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,IAAI,CAAC,EAAE,OAAO,CAAC;CACf;AAED,sFAAsF;AACtF,MAAM,WAAW,oBAAqB,SAAQ,KAAK;IAClD,MAAM,EAAE,MAAM,CAAC;CACf;AAED,eAAO,MAAM,aAAa,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,eAEG,CAAC;AAE5D,eAAO,MAAM,kBAAkB,GAC9B,OAAO,OAAO,KACZ,KAAK,IAAI,oBAE+C,CAAC"}
+{"version":3,"file":"api-error.d.ts","sourceRoot":"","sources":["../../src/errors/api-error.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,4EAA4E;AAC5E,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mDAAmD;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACpD;AAED,yFAAyF;AACzF,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAChC;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC;IACrC,iEAAiE;IACjE,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC/C,4DAA4D;IAC5D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,qCAAqC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,qEAAqE;IACrE,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CAChC;AAED,0CAA0C;AAC1C,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,sBAAsB,CAAC;CAC7C;AAED,kFAAkF;AAClF,MAAM,WAAW,YAAa,SAAQ,KAAK;IAC1C,QAAQ,CAAC,MAAM,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC9C,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,sCAAsC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,4GAA4G;AAC5G,eAAO,MAAM,OAAO,GAAI,OAAO,OAAO,EAAE,MAAM,MAAM,KAAG,KAAK,IAAI,KAClB,CAAC;AAE/C;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,YAAY,CAMpE;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAC1B,UAAU,EAAE,sBAAsB,GAAG,SAAS,GAC5C,MAAM,CAKR;AAeD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,GAAG,SAAS,CAMpE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,GAAG,SAAS,CAWtE;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CACvB,UAAU,EAAE,sBAAsB,GAAG,SAAS,GAC5C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAKrC;AAED,iFAAiF;AACjF,MAAM,WAAW,eAAgB,SAAQ,KAAK;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,IAAI,CAAC,EAAE,OAAO,CAAC;CACf;AAED,sFAAsF;AACtF,MAAM,WAAW,oBAAqB,SAAQ,KAAK;IAClD,MAAM,EAAE,MAAM,CAAC;CACf;AAED,eAAO,MAAM,aAAa,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,eAEG,CAAC;AAE5D,eAAO,MAAM,kBAAkB,GAC9B,OAAO,OAAO,KACZ,KAAK,IAAI,oBAE+C,CAAC"}

package/dist/errors/index.d.ts

@@ -1,4 +1,4 @@
-export { type ApiErrorEntryLike, type ApiErrorExtensionsLike, type ApiErrorLike, type ApiErrorParamsLike, type ApiFieldErrorLike, isApiErrorLike, waitMinutes, } from './api-error';
+export { type ApiErrorEntryLike, type ApiErrorExtensionsLike, type ApiErrorLike, type ApiErrorParamsLike, type ApiFieldErrorLike, attemptsLeftOf, isApiErrorLike, waitMinutes, } from './api-error';
 export { type ApiErrors, type ApiErrorsOptions, type ApiRefusal, createApiErrors, } from './api-errors';
 export { apiCallFailure, type CallFailureOptions, type DocumentLike, operationName, } from './call-failure';
 export { type CatalogueReply, createErrorCatalogue, type ErrorCatalogue, type ErrorCatalogueOptions, } from './catalogue';

package/dist/errors/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/errors/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,cAAc,EACd,WAAW,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,eAAe,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,cAAc,EACd,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,aAAa,GACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACN,KAAK,cAAc,EACnB,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,qBAAqB,GAC1B,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,eAAe,EACf,KAAK,aAAa,GAClB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EACN,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,WAAW,GACX,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACN,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,iBAAiB,EACjB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,SAAS,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EACN,mBAAmB,EACnB,KAAK,wBAAwB,GAC7B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EACN,cAAc,EACd,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,UAAU,GACV,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,KAAK,QAAQ,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/errors/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,cAAc,EACd,cAAc,EACd,WAAW,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,eAAe,GACf,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,cAAc,EACd,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,aAAa,GACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACN,KAAK,cAAc,EACnB,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,qBAAqB,GAC1B,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,eAAe,EACf,KAAK,aAAa,GAClB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EACN,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,WAAW,GACX,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACN,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,iBAAiB,EACjB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,SAAS,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EACN,mBAAmB,EACnB,KAAK,wBAAwB,GAC7B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EACN,cAAc,EACd,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,UAAU,GACV,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,KAAK,QAAQ,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC"}