@aventara/client 1.0.0-rc.1 → 1.0.0-rc.10

package/CHANGELOG.md

@@ -1,5 +1,199 @@
 # @aventara/client
 
+## 1.0.0-rc.10
+
+### Patch Changes
+
+- 7ee547b: A ClientContract whose `access` section states Aventara Access's `kiosk` verbs gives the generated client
+  `$access.switchUser`, `lock`, `setPin`, `enrollDevice` and `revokeDevice`, each a `POST` to Access's own route with its
+  arguments typed from the section's schema and its answer projected onto the result schema (`lock`, `setPin` and
+  `revokeDevice` resolve nothing). A section without them emits no member for them.
+- d7e7369: A ClientContract with the `access` section gives the generated client `$access`: `can(questions)` (one request to
+  `/_access/can`), and exactly the Aventara Access verbs the section states (`me` with `GET` and `cache: "no-store"`,
+  `signIn`, `signUp`, `signOut`, `resetPassword`), each result projected onto the section's schema. `AvAccessMe` is
+  `me`'s result type and `AvAccessError` what a non-2xx Access answer throws. A client without the section is emitted
+  byte for byte as before. A ClientContract whose Access URL is on another origin than the
+  entrypoint's is refused unless `framework.client.ts` lists that origin in the new `accessOrigins`.
+- 9d423f9: `avclient generate`'s reference step (a solution-style `tsconfig.json`) matches `${configDir}` entries of `files`,
+  `include` and `exclude`. `get-tsconfig` 4.10.0 makes them absolute and its file matcher joined them under the config's
+  directory again, so a referenced project including the client through `${configDir}` was passed over.
+- 04bb39a: `engines.node` is now `^22.23.4 || >=24.22.1`, the Node security releases of 2026-10-20 (CVE-2026-105481,
+  CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-106072, CVE-2026-106073, CVE-2026-106074,
+  CVE-2026-111497). The bins refuse an older Node in one sentence naming that range.
+- 88263a1: A value projected onto an `access` verb's result schema is refused with the projector's own `TypeError` when the schema
+  is outside the forms a Client Contract states (a free-form object or list, a tuple read past its length), whatever the
+  value, an empty one included. A Client Contract that passed its structure check never holds such a schema.
+- Updated dependencies [587dd01]
+- Updated dependencies [d7e7369]
+- Updated dependencies [7ee547b]
+- Updated dependencies [f52c499]
+- Updated dependencies [2907484]
+- Updated dependencies [a6bbdf0]
+- Updated dependencies [3e26549]
+- Updated dependencies [a6bbdf0]
+- Updated dependencies [6f3f6f6]
+- Updated dependencies [04bb39a]
+- Updated dependencies [3fb3333]
+- Updated dependencies [827ccb6]
+- Updated dependencies [7f5abc3]
+- Updated dependencies [88263a1]
+- Updated dependencies [10341d5]
+- Updated dependencies [8129844]
+- Updated dependencies [88263a1]
+- Updated dependencies [3020b5c]
+- Updated dependencies [88263a1]
+- Updated dependencies [88263a1]
+  - @aventara/core@1.0.0-rc.10
+
+## 1.0.0-rc.9
+
+### Patch Changes
+
+- 99278e4: `aventara-build` reads a Next.js project's files from `src/aventara/` and, with `--client`, writes its browser client.
+
+  - A project whose `package.json` depends on `@aventara/next` keeps its configuration and adapter in
+    `src/aventara/config.ts` and `src/aventara/adapter.ts`; the build runs them there, and a configuration that imports no
+    Resource tree has its generated files in `src/aventara/generated/`. Every other project keeps
+    `src/aventara.config.ts` and `src/aventara.adapter.ts`, unchanged. A missing file is named with where the project's
+    host keeps it, and a project depending on both `@aventara/nest` and `@aventara/next` is refused in one sentence.
+  - `aventara-build --client` also writes the browser client from the ClientContract it has just compiled, with no
+    running server: `src/aventara/client.ts` and the client's modules under `src/aventara/generated/`, the same modules
+    `avclient generate` writes for that ClientContract except that the entrypoint is the app's own `api` on the page's
+    origin (`/api`) and the regenerate instructions. Its imports are spelled as the project's `tsconfig.json` says, and nothing it writes imports
+    `@aventara/client`.
+  - `src/aventara/client.ts` exports `avClient` and `avHydrate`, and re-exports every name `avclient generate`'s
+    `AvClient.ts` exports besides its default (`AvClient`, the Resource types, the enums, `AvDecimal`, the error
+    classes), so `import { AvDecimal } from "@/aventara/client"` works. The generated files and the contract-mismatch
+    error say to regenerate with `aventara-build --client` (the project's `aventara:prepare` script). `avClient` calls the API from the browser; a call made
+    on the server (a Client Component rendering there) rejects with one sentence pointing to `@/aventara/server` and
+    `@/aventara/universal`, and sends nothing. `avHydrate` revives data `avDehydrate` sends from the server: tagged
+    dates, `bigint`s, byte arrays and decimals become `Date`, `bigint`, `Uint8Array` and the client's own `AvDecimal`,
+    for TanStack Query's `deserializeData` or an SWR `fallback`.
+  - `aventara-build --check --client` checks those files too: a missing or stale one, or one an earlier ClientContract's
+    client left, exits 1 naming it. `--client` is refused in a NestJS project, whose frontends keep using
+    `avclient generate`, which is unchanged.
+  - `@aventara/client` gains an `@aventara/client/internal` entry, which `@aventara/build` reads the generator through.
+    It is not public API.
+
+- Updated dependencies [205a379]
+- Updated dependencies [a0bb05e]
+- Updated dependencies [86ab319]
+- Updated dependencies [fdf52e6]
+  - @aventara/core@1.0.0-rc.9
+
+## 1.0.0-rc.8
+
+1.0.0-rc.5, rc.6 and rc.7 were tagged but never published; 1.0.0-rc.8 contains everything listed under them and the changes below.
+
+### Patch Changes
+
+- A generated client's results read as their value types in an editor: `body: string | null`, `published: boolean`,
+  `publishedAt: Date | null`, where a nullable, enum or `boolean` field was shown as `AvScalarValueType<…>` with the
+  client's Contract as its argument, and a result as `ProjectedFields<…>`. Run `avclient generate` again to pick it up.
+  What the client accepts and returns is unchanged.
+- Updated dependencies [1c8e4ee]
+  - @aventara/core@1.0.0-rc.8
+
+## 1.0.0-rc.7
+
+1.0.0-rc.5 and 1.0.0-rc.6 were tagged but never published; 1.0.0-rc.7 contains everything listed under them and the changes below.
+
+### Patch Changes
+
+- Updated dependencies [f917c1c]
+  - @aventara/core@1.0.0-rc.7
+
+## 1.0.0-rc.6
+
+1.0.0-rc.5 was tagged but never published. 1.0.0-rc.6 contains everything listed under 1.0.0-rc.5 and the fix below.
+
+### Patch Changes
+
+- Updated dependencies [1cf72e0]
+  - @aventara/core@1.0.0-rc.6
+
+## 1.0.0-rc.5
+
+### Patch Changes
+
+- Updated dependencies [4795ff1]
+- Updated dependencies [9e178ca]
+  - @aventara/core@1.0.0-rc.5
+
+## 1.0.0-rc.4
+
+### Patch Changes
+
+- Updated dependencies [e3d03a7]
+- Updated dependencies [d10639a]
+- Updated dependencies [f67e68c]
+- Updated dependencies [708556c]
+- Updated dependencies [3a0dfca]
+- Updated dependencies [99169d2]
+- Updated dependencies [0fd2608]
+- Updated dependencies [154e440]
+- Updated dependencies [2fcffdb]
+  - @aventara/core@1.0.0-rc.4
+
+## 1.0.0-rc.3
+
+### Patch Changes
+
+- Updated dependencies [b38034d]
+- Updated dependencies [b38034d]
+- Updated dependencies [b38034d]
+- Updated dependencies [b38034d]
+- Updated dependencies [b38034d]
+- Updated dependencies [b38034d]
+  - @aventara/core@1.0.0-rc.3
+
+## 1.0.0-rc.2
+
+### Patch Changes
+
+- The optional `typescript` peer range is `>=5.7.0` (it was `>=5.5.0`), the lowest TypeScript Aventara's types
+  compile under. `avclient generate` type-checks the client with TypeScript 5.7 or later; under an older one it parses
+  the output with Node's TypeScript parser (`checked: syntax`) and says so in one warning, as it did below 5.5.
+- A generated client sends an `undefined` array element (or a hole) as `null`, as `JSON.stringify` writes it, and its
+  `json` codec leaves out a key holding `undefined` and writes such an element as `null`. A `json` value
+  `{ a: undefined, b: [undefined] }` is sent as `{"b":[null]}`, the value the server stores when an in-process caller
+  passes it. In rc.1 the client refused the array element with a `TypeError` before sending. Regenerate the client.
+- A generated client's `json` values admit a key holding `undefined` in their type, as core's `AvJsonValue` now does,
+  so an object with optional properties can be passed where a `json` value is taken; the key is not sent. In rc.1 it
+  was a compile error. Regenerate the client.
+- A generated client refuses at compile time a filter `mode` or `path` that qualifies no operator: one alone, or one
+  whose only neighbour is a `not` holding operators (`{ mode: "insensitive", not: { contains: "x" } }`). Write it
+  inside the `not`. The server refuses the same filters (`A2004`, `V1001`). Regenerate the client.
+- A generated client types a filter's `mode` by the field: `"default"` always, and `"sensitive"` or `"insensitive"`
+  only where the ClientContract's `filterModes` lists them; any other mode is a compile error. On a `json` field an
+  operator object that names `path` takes the modes `pathFilterModes` lists instead, so on Postgres
+  `where: { meta: { stringContains: "x", mode: "insensitive" } }` is a compile error and
+  `where: { meta: { path: ["label"], stringContains: "x", mode: "insensitive" } }` compiles. `isEmpty` is typed as a boolean, `path` as an array of strings and a `json` field's `string*`
+  operand as a string. The server refuses the same values (`A2004`), so the client adds no runtime check of its own.
+  Regenerate the client: the Contract hash changes.
+- The generated client refuses an `undefined` value in a filter before anything is sent. JSON drops `undefined`, so
+  `avClient.Post.update.many({ where: { id: undefined }, data })` reached the server as `where: {}` and updated every
+  row; the same went for `find`, `count`, `delete` and a transaction step. Now an `undefined` anywhere inside a
+  `where` (`AND`, `OR`, `NOT`, relation filters, operator objects such as `{ equals: undefined }` or
+  `{ isEmpty: undefined }`, `in` lists), a `cursor`, a unique selector, the `where` or `cursor` of a relation in
+  `select` or `include`, or a nested write's selectors (`$connect`, `$disconnect`, `$set`, `$delete`, the `where` of
+  `$update`, `$upsert` and `$connectOrCreate`) throws `AvValidationError` (`A2004`) with a `V1001` issue at the path
+  the server uses (`["arguments", "where", "id"]`, or `["operations", 0, "args", "where", "id"]` with the step's
+  `operation` for a transaction), and no request is made. A `where`, `cursor`, `limit` or `offset` that is itself
+  `undefined` is refused the same way, with the server's code (`V1001`; `V1007` for a unique selector, `V1009` for a
+  cursor), at the top level, in a relation under `select` or `include`, and in a nested write's `where`. Leave the
+  key out to mean no filter. Write data is unchanged: an `undefined` field there is not sent. Regenerate the client
+  to get the check.
+- `avclient generate` in a directory with no config names the extensions it looks for as the docs list them:
+  `no framework.client.ts, .mts, .cts, .js, .mjs or .cjs in <directory>; …`. In rc.1 it read
+  `no framework.client.{js,ts,mjs,cjs,mts,cts} in <directory>`. `avclient --help` and `avclient generate --help` list
+  them in the same order: `framework.client.ts (or .mts, .cts, .js, .mjs, .cjs)`. Which files are read is unchanged.
+- Updated dependencies [9366e16]
+- Updated dependencies [9366e16]
+- Updated dependencies [9366e16]
+- Updated dependencies [9366e16]
+  - @aventara/core@1.0.0-rc.2
+
 ## 1.0.0-rc.1
 
 ### Patch Changes

package/README.md

@@ -96,7 +96,7 @@ A failed run leaves the previous output exactly as it was. The whole tree is wri
 `generateAt`, validated there as one program, and only then moved into place. A run killed part-way is repaired by the
 next run that writes, before it writes anything. A first run that fails removes the directories it created.
 
-The validate step is a real type check when your project has the optional peer `typescript` (5.5 to 6). It is resolved
+The validate step is a real type check when your project has the optional peer `typescript` (5.7 to 6). It is resolved
 from your project, so `npx @aventara/client@rc init` type-checks too, under a consumer's strictest plausible settings
 and with nothing outside the tree resolvable. Without it, or under TypeScript 7 (which has no classic compiler API to
 check with), the check falls back to a parse with Node's own TypeScript parser and says so in one warning. It is never
@@ -192,6 +192,42 @@ The platform `fetch` is read when a call is made, not when the client is importe
 where there is no `fetch`; a call does, saying why. An entrypoint carrying credentials is refused when the config is
 resolved.
 
+## Aventara Access: `$access`
+
+When the deployment's ClientContract has the `access` section (the framework is configured with `access`), the client
+has `$access`:
+
+```ts
+const answers = await avClient.$access.can([
+	{ resource: "Order", action: "update", where: { id: 41 } },
+	{ resource: "Refund", action: "create" },
+]); // [boolean, boolean], one request to /_access/can
+await avClient.$access.signIn({ email, password }); // Access's own route
+const me = await avClient.$access.me(); // AvAccessMe | null
+```
+
+`can` is always there; `me`, `signIn`, `signUp`, `signOut` and `resetPassword`, and on Access's `kiosk` profile
+`switchUser`, `lock`, `setPin`, `enrollDevice` and `revokeDevice`, exactly when the section states them.
+Each verb calls Access's own route (`me` with `GET` and `cache: "no-store"`), and resolves its result projected onto the
+section's schema: members the schema does not declare are dropped. `AvAccessMe` is `me`'s result type. A non-2xx answer
+from Access throws `AvAccessError` (`status`, `code`, `message`); `can`'s refusals are `AvError`s, as every call's.
+Without the section there is no `$access`.
+
+Where Access lives decides where a sign-in's credentials go, so the generator emits an absolute Access URL only when it
+is on the entrypoint's origin, or on an origin `framework.client.ts` lists:
+
+```ts
+export default defineClientConfig({
+	entrypoint: env("AVENTARA_API_URL"),
+	generateAt: "./src/api",
+	accessOrigins: ["https://auth.example.com"],
+});
+```
+
+A verb on another origin carries cookies only when your `fetch` sends them: pass one that does
+(`new AvClient({ fetch: (url, init) => fetch(url, { ...init, credentials: "include" }) })`), and have Access allow
+that origin with credentials (CORS).
+
 ## Up to date
 
 A rerun asks the deployment conditionally (`If-None-Match`, the ClientContract hash of the output it finds), but only

package/dist/cli/command.parser.d.ts

@@ -1,5 +1,5 @@
-export declare const USAGE = "avclient \u2014 generate a typed Aventara client from a deployed ClientContract.\n\nUsage:\n  avclient generate [--yes]   Read framework.client.ts (or .js, .mjs, .cjs, .mts,\n                              .cts) in the current directory, fetch\n                              <entrypoint>/_contract, and write AvClient.ts and\n                              generated/ into its generateAt directory, its imports\n                              spelled as the project's tsconfig.json says.\n  avclient init [options]     Set up this frontend: write framework.client.ts, the\n                              .env entry, the avclient:generate script and the\n                              @aventara/client devDependency; install; generate.\n      --entrypoint <url>      The server's entrypoint [http://localhost:3000/api].\n      --env-var <NAME>        Read it from this variable [AVENTARA_API_URL].\n      --no-env-var            Write it into framework.client.ts as a literal.\n      --generate-at <dir>     Where the client goes [./src/api].\n      --package-manager <npm|pnpm>   [the lockfile's, else the launching one, else npm]\n      --skip-install          Print the install instead of running it.\n      --skip-generate         Do not generate now.\n      -y, --yes               Accept every default, and replace differing content.\n  avclient --help             Print this and exit 0.\n  avclient <command> --help   Print that command's usage and exit 0.\n  avclient --version, -v      Print this generator's version and exit 0.\n\nOptions:\n  -y, --yes   Overwrite or remove content in AvClient.ts and generated/ that the\n              generator did not produce, without asking. Without it, such content\n              is listed and you are asked; where nobody can answer (stdin is not a\n              terminal, as in CI), the run is refused and nothing is touched.\n\nThe generator owns AvClient.ts and generated/ in generateAt, and nothing else\nthere: your own files beside them are never read, moved or removed. Generated\nfiles are replaced on every run; do not edit them.\n\nBefore framework.client.ts is evaluated, the .env cascade is read from the\ncurrent directory, highest precedence first: the process environment,\n.env.<mode>.local, .env.<mode>, .env.local, .env \u2014 where mode is NODE_ENV, or\n\"development\".\n";
-export declare const GENERATE_USAGE = "Usage: avclient generate [--yes]\n\nRead framework.client.ts (or .js, .mjs, .cjs, .mts, .cts) in the current directory,\nfetch <entrypoint>/_contract, and write AvClient.ts and generated/ into its\ngenerateAt directory, its imports spelled as the project's tsconfig.json says.\n\nOptions:\n  -y, --yes   Overwrite or remove content in AvClient.ts and generated/ that the\n              generator did not produce, without asking. Without it, such content\n              is listed and you are asked; where nobody can answer (stdin is not a\n              terminal, as in CI), the run is refused and nothing is touched.\n\nThe generator owns AvClient.ts and generated/ in generateAt, and nothing else\nthere: your own files beside them are never read, moved or removed.\n\nBefore the config is evaluated, the .env cascade is read from the current\ndirectory, highest precedence first: the process environment, .env.<mode>.local,\n.env.<mode>, .env.local, .env \u2014 where mode is NODE_ENV, or \"development\".\n";
+export declare const USAGE = "avclient \u2014 generate a typed Aventara client from a deployed ClientContract.\n\nUsage:\n  avclient generate [--yes]   Read framework.client.ts (or .mts, .cts, .js, .mjs,\n                              .cjs) in the current directory, fetch\n                              <entrypoint>/_contract, and write AvClient.ts and\n                              generated/ into its generateAt directory, its imports\n                              spelled as the project's tsconfig.json says.\n  avclient init [options]     Set up this frontend: write framework.client.ts, the\n                              .env entry, the avclient:generate script and the\n                              @aventara/client devDependency; install; generate.\n      --entrypoint <url>      The server's entrypoint [http://localhost:3000/api].\n      --env-var <NAME>        Read it from this variable [AVENTARA_API_URL].\n      --no-env-var            Write it into framework.client.ts as a literal.\n      --generate-at <dir>     Where the client goes [./src/api].\n      --package-manager <npm|pnpm>   [the lockfile's, else the launching one, else npm]\n      --skip-install          Print the install instead of running it.\n      --skip-generate         Do not generate now.\n      -y, --yes               Accept every default, and replace differing content.\n  avclient --help             Print this and exit 0.\n  avclient <command> --help   Print that command's usage and exit 0.\n  avclient --version, -v      Print this generator's version and exit 0.\n\nOptions:\n  -y, --yes   Overwrite or remove content in AvClient.ts and generated/ that the\n              generator did not produce, without asking. Without it, such content\n              is listed and you are asked; where nobody can answer (stdin is not a\n              terminal, as in CI), the run is refused and nothing is touched.\n\nThe generator owns AvClient.ts and generated/ in generateAt, and nothing else\nthere: your own files beside them are never read, moved or removed. Generated\nfiles are replaced on every run; do not edit them.\n\nBefore framework.client.ts is evaluated, the .env cascade is read from the\ncurrent directory, highest precedence first: the process environment,\n.env.<mode>.local, .env.<mode>, .env.local, .env \u2014 where mode is NODE_ENV, or\n\"development\".\n";
+export declare const GENERATE_USAGE = "Usage: avclient generate [--yes]\n\nRead framework.client.ts (or .mts, .cts, .js, .mjs, .cjs) in the current directory,\nfetch <entrypoint>/_contract, and write AvClient.ts and generated/ into its\ngenerateAt directory, its imports spelled as the project's tsconfig.json says.\n\nOptions:\n  -y, --yes   Overwrite or remove content in AvClient.ts and generated/ that the\n              generator did not produce, without asking. Without it, such content\n              is listed and you are asked; where nobody can answer (stdin is not a\n              terminal, as in CI), the run is refused and nothing is touched.\n\nThe generator owns AvClient.ts and generated/ in generateAt, and nothing else\nthere: your own files beside them are never read, moved or removed.\n\nBefore the config is evaluated, the .env cascade is read from the current\ndirectory, highest precedence first: the process environment, .env.<mode>.local,\n.env.<mode>, .env.local, .env \u2014 where mode is NODE_ENV, or \"development\".\n";
 export declare const INIT_USAGE = "Usage: avclient init [options]\n\nSet up this frontend: write framework.client.ts, the .env entry, the avclient:generate\nscript and the @aventara/client devDependency; install; generate.\n\nOptions:\n  --entrypoint <url>             The server's entrypoint [http://localhost:3000/api].\n  --env-var <NAME>               Read it from this variable [AVENTARA_API_URL].\n  --no-env-var                   Write it into framework.client.ts as a literal.\n  --generate-at <dir>            Where the client goes [./src/api].\n  --package-manager <npm|pnpm>   [the lockfile's, else the launching one, else npm]\n  --skip-install                 Print the install instead of running it.\n  --skip-generate                Do not generate now.\n  --verbose                      Show the install's output as it runs.\n  -y, --yes                      Accept every default, and replace differing content.\n\nOn a terminal every unanswered question is asked; anywhere else, pass its flag\nor --yes, or the run stops before writing anything.\n";
 export type ClientInitCommand = {
     readonly command: "init";
@@ -12,7 +12,7 @@ export type ClientInitCommand = {
     readonly verbose?: boolean;
 };
 /** What the command line asked for. */
-export type CliCommand = {
+type CliCommand = {
     readonly command: "help";
     readonly topic?: "generate" | "init";
 } | {
@@ -30,3 +30,4 @@ export declare class AvCliCommandError extends Error {
  *   `--help`/`-h` or `--version`/`-v`.
  */
 export declare function parseCliCommand(argv: readonly string[]): CliCommand;
+export {};

package/dist/cli/command.parser.js

@@ -2,8 +2,8 @@ import { CLIENT_CONFIG_FILE } from "../config/config.loader.js";
 export const USAGE = `avclient — generate a typed Aventara client from a deployed ClientContract.
 
 Usage:
-  avclient generate [--yes]   Read ${CLIENT_CONFIG_FILE} (or .js, .mjs, .cjs, .mts,
-                              .cts) in the current directory, fetch
+  avclient generate [--yes]   Read ${CLIENT_CONFIG_FILE} (or .mts, .cts, .js, .mjs,
+                              .cjs) in the current directory, fetch
                               <entrypoint>/_contract, and write AvClient.ts and
                               generated/ into its generateAt directory, its imports
                               spelled as the project's tsconfig.json says.
@@ -39,7 +39,7 @@ current directory, highest precedence first: the process environment,
 `;
 export const GENERATE_USAGE = `Usage: avclient generate [--yes]
 
-Read ${CLIENT_CONFIG_FILE} (or .js, .mjs, .cjs, .mts, .cts) in the current directory,
+Read ${CLIENT_CONFIG_FILE} (or .mts, .cts, .js, .mjs, .cjs) in the current directory,
 fetch <entrypoint>/_contract, and write AvClient.ts and generated/ into its
 generateAt directory, its imports spelled as the project's tsconfig.json says.
 

package/dist/cli/generation-failure.renderer.d.ts

@@ -1,6 +1,7 @@
-export interface GenerationFailureReport {
+interface GenerationFailureReport {
     readonly exitCode: number;
     /** What goes to stderr, newline-terminated: the warnings carried, then the sentence. */
     readonly text: string;
 }
 export declare function renderGenerationFailure(error: unknown): GenerationFailureReport;
+export {};

package/dist/cli/generation-success.renderer.d.ts

@@ -6,7 +6,7 @@ import type { ClientGenerated, ClientUpToDate, ForeignOutputContent } from "../g
  * them — renames, the degraded check, crash recovery — so the same run prints the
  * same lines.
  */
-export interface GenerationSuccessReport {
+interface GenerationSuccessReport {
     /** What goes to stdout, newline-terminated. */
     readonly stdout: string;
     /** What goes to stderr: one line per warning, or nothing. */
@@ -29,3 +29,4 @@ export declare const FOREIGN_CONTENT_QUESTION = "avclient: overwrite them and ge
  * are reported as a refused one's are.
  */
 export declare function renderForeignContentCancellation(found: ForeignOutputContent, asked: boolean): string;
+export {};

package/dist/cli/step.reporter.d.ts

@@ -1,7 +1,7 @@
 export type ProgressMode = "live" | "plain" | "off";
 /** `live` only on a terminal that is not CI and accepts control sequences. */
 export declare function progressModeOf(isTTY: boolean | undefined, env: Readonly<Record<string, string | undefined>>): Exclude<ProgressMode, "off">;
-export type StepReporterOptions = {
+type StepReporterOptions = {
     /** Where the lines go: the tool's stderr, so its stdout stays its result. */
     readonly write: (text: string) => void;
     readonly mode: ProgressMode;
@@ -29,3 +29,4 @@ export type StepReporter = {
 /** `12.4s`, or `1m 02s` from a minute. */
 export declare function formatElapsed(milliseconds: number): string;
 export declare function createStepReporter(options: StepReporterOptions): StepReporter;
+export {};

package/dist/cli/terminal.prompter.d.ts

@@ -1,6 +1,7 @@
-export type TerminalPrompter = {
+type TerminalPrompter = {
     readonly ask: (prompt: string) => Promise<string>;
     readonly confirm: (question: string) => Promise<boolean>;
     readonly close: () => void;
 };
 export declare function createTerminalPrompter(): TerminalPrompter;
+export {};

package/dist/config/client-config.interface.d.ts

@@ -28,6 +28,13 @@ export interface AvClientConfigInput {
      * `generateAt` is used.
      */
     readonly tsconfigFile?: string;
+    /**
+     * The origins other than the entrypoint's that `$access` may send a
+     * sign-in to (`"https://auth.example.com"`): where the deployment mounted
+     * Aventara Access, when that is another origin. Absent, the generator
+     * refuses a ClientContract whose Access URL is on another origin.
+     */
+    readonly accessOrigins?: readonly AvClientConfigValue[];
 }
 /** A filesystem path known to be absolute. */
 export type AbsolutePath = string & {
@@ -44,11 +51,21 @@ export interface ClientEntrypoint {
     readonly deployment: URL;
     readonly path: EntrypointPath;
 }
+/** An entrypoint on the page's own origin: its mount path alone, such as `/api`. */
+export interface SameOriginEntrypoint {
+    /** Absent: the deployment is whichever origin served the page. */
+    readonly deployment?: undefined;
+    readonly path: EntrypointPath;
+}
+/** The entrypoint a generated client embeds as its default: a deployment's, or the page's own origin. */
+export type EmittedEntrypoint = ClientEntrypoint | SameOriginEntrypoint;
 export interface ResolvedClientConfig {
     readonly entrypoint: ClientEntrypoint;
     /** `generateAt`, made absolute. */
     readonly generateAt: AbsolutePath;
     /** `tsconfigFile`, made absolute; absent when the config names none. */
     readonly tsconfigFile?: AbsolutePath;
+    /** `accessOrigins`, each an http(s) origin (`scheme://host[:port]`); empty when the config names none. */
+    readonly accessOrigins: readonly string[];
     readonly mode: string;
 }

package/dist/config/config.loader.d.ts

@@ -1,11 +1,15 @@
 import type { AvClientConfigInput } from "./client-config.interface.js";
 /** Prisma's `SUPPORTED_EXTENSIONS`, in its order. */
 export declare const CLIENT_CONFIG_FILE_EXTENSIONS: readonly [".js", ".ts", ".mjs", ".cjs", ".mts", ".cts"];
-/** The config's name, before its extension. */
-export declare const CLIENT_CONFIG_BASENAME = "framework.client";
+/**
+ * The same extensions as the docs and `avclient --help` list them, TypeScript
+ * first: the order a sentence to the developer names them in. Lookup keeps
+ * {@link CLIENT_CONFIG_FILE_EXTENSIONS}' order, Prisma's.
+ */
+export declare const CLIENT_CONFIG_FILE_EXTENSIONS_AS_LISTED: readonly [".ts", ".mts", ".cts", ".js", ".mjs", ".cjs"];
 /** The config file `avclient init` writes when the project has none. */
 export declare const CLIENT_CONFIG_FILE = "framework.client.ts";
-export interface LoadedClientConfig {
+interface LoadedClientConfig {
     /** The config file's absolute path; `generateAt` resolves against its directory. */
     readonly file: string;
     readonly config: AvClientConfigInput;
@@ -30,3 +34,4 @@ export declare function findClientConfigFile(directory: string): string | undefi
  *   or the file does not evaluate, or does not default-export a client config.
  */
 export declare function loadClientConfigFile(directory: string): Promise<LoadedClientConfig>;
+export {};

package/dist/config/config.loader.js

@@ -9,7 +9,15 @@ export const CLIENT_CONFIG_FILE_EXTENSIONS = [
     ".mts",
     ".cts",
 ];
-export const CLIENT_CONFIG_BASENAME = "framework.client";
+export const CLIENT_CONFIG_FILE_EXTENSIONS_AS_LISTED = [
+    ".ts",
+    ".mts",
+    ".cts",
+    ".js",
+    ".mjs",
+    ".cjs",
+];
+const CLIENT_CONFIG_BASENAME = "framework.client";
 export const CLIENT_CONFIG_FILE = `${CLIENT_CONFIG_BASENAME}.ts`;
 export function clientConfigFilesIn(directory) {
     return CLIENT_CONFIG_FILE_EXTENSIONS.map((extension) => `${CLIENT_CONFIG_BASENAME}${extension}`).filter((name) => statSync(path.resolve(directory, name), {
@@ -27,7 +35,8 @@ export function findClientConfigFile(directory) {
 export async function loadClientConfigFile(directory) {
     const name = findClientConfigFile(directory);
     if (name === undefined) {
-        throw new AvClientConfigError(`no ${CLIENT_CONFIG_BASENAME}.{${CLIENT_CONFIG_FILE_EXTENSIONS.map((extension) => extension.slice(1)).join(",")}} in ${path.resolve(directory)}; create ${CLIENT_CONFIG_FILE} with ` +
+        const [first, ...others] = CLIENT_CONFIG_FILE_EXTENSIONS_AS_LISTED;
+        throw new AvClientConfigError(`no ${CLIENT_CONFIG_BASENAME}${first}, ${others.slice(0, -1).join(", ")} or ${others.at(-1)} in ${path.resolve(directory)}; create ${CLIENT_CONFIG_FILE} with ` +
             "`export default defineClientConfig({ entrypoint, generateAt })` (or run `avclient init`) and run the generator from its directory.");
     }
     const file = path.resolve(directory, name);
@@ -66,10 +75,19 @@ function clientConfigOf(file, config) {
     if (tsconfigFile !== undefined && typeof tsconfigFile !== "string") {
         throw new AvClientConfigError(`${file}'s tsconfigFile must be a string, a path relative to ${path.dirname(file)}.`);
     }
+    const accessOrigins = members.accessOrigins;
+    if (accessOrigins !== undefined && !Array.isArray(accessOrigins)) {
+        throw new AvClientConfigError(`${file}'s accessOrigins must be a list of origins ("https://auth.example.com"), each a string or env("NAME").`);
+    }
     return {
         entrypoint: configValueOf(file, "entrypoint", members.entrypoint),
         generateAt: configValueOf(file, "generateAt", members.generateAt),
         ...(tsconfigFile === undefined ? {} : { tsconfigFile }),
+        ...(accessOrigins === undefined
+            ? {}
+            : {
+                accessOrigins: accessOrigins.map((origin) => configValueOf(file, "accessOrigins", origin)),
+            }),
     };
 }
 function configValueOf(file, member, value) {

package/dist/config/config.resolver.d.ts

@@ -1,4 +1,4 @@
-import type { AvClientConfigInput, AvEnvReference, ClientEntrypoint, ResolvedClientConfig } from "./client-config.interface.js";
+import type { AvClientConfigInput, AvEnvReference, ClientEntrypoint, EmittedEntrypoint, ResolvedClientConfig, SameOriginEntrypoint } from "./client-config.interface.js";
 import type { EnvCascadeResolution } from "./env.cascade.js";
 /** Gives a `framework.client.ts` its type: returns `config` unchanged. */
 export declare function defineClientConfig(config: AvClientConfigInput): AvClientConfigInput;
@@ -11,7 +11,7 @@ export declare function env(name: string): AvEnvReference;
 export declare class AvClientConfigError extends Error {
     readonly name = "AvClientConfigError";
 }
-export interface ClientConfigResolutionInput {
+interface ClientConfigResolutionInput {
     readonly config: AvClientConfigInput;
     readonly cascade: EnvCascadeResolution;
     /** The directory holding the config file; `generateAt` resolves against it. */
@@ -26,4 +26,11 @@ export declare function resolveClientConfig(input: ClientConfigResolutionInput):
  * @throws AvClientConfigError in one sentence that does not echo the value.
  */
 export declare function resolveEntrypoint(value: string): ClientEntrypoint;
-export declare function entrypointHref(entrypoint: ClientEntrypoint): string;
+/**
+ * The same-origin entrypoint of a framework mounted at `api`.
+ *
+ * @throws AvClientConfigError when `api` is not a mount path.
+ */
+export declare function sameOriginEntrypoint(api: string): SameOriginEntrypoint;
+export declare function entrypointHref(entrypoint: EmittedEntrypoint): string;
+export {};

package/dist/config/config.resolver.js

@@ -24,9 +24,27 @@ export function resolveClientConfig(input) {
             : {
                 tsconfigFile: path.resolve(input.configDirectory, tsconfigFile),
             }),
+        accessOrigins: (input.config.accessOrigins ?? []).map((origin) => resolveAccessOrigin(resolveValue("accessOrigins", origin, input.cascade))),
         mode: input.cascade.mode,
     };
 }
+function resolveAccessOrigin(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        url = undefined;
+    }
+    if (url === undefined ||
+        (url.protocol !== "http:" && url.protocol !== "https:") ||
+        url.username !== "" ||
+        url.password !== "" ||
+        url.origin !== value.replace(/\/$/u, "").toLowerCase()) {
+        throw new AvClientConfigError('accessOrigins holds a value that is no http(s) origin; each must be scheme, host and port alone ("https://auth.example.com").');
+    }
+    return url.origin;
+}
 function resolveValue(field, value, cascade) {
     if (typeof value === "string") {
         if (value === "")
@@ -77,7 +95,17 @@ export function resolveEntrypoint(value) {
 function writtenMountPath(value) {
     return value.replace(/^[A-Za-z][A-Za-z0-9+.-]*:[/\\]*[^/\\?#]*/u, "");
 }
+export function sameOriginEntrypoint(api) {
+    const normalized = AvProtocol.normalizeEntrypoint(api);
+    if (!normalized.ok) {
+        throw new AvClientConfigError(`api ${normalized.message}.`);
+    }
+    return { path: normalized.path };
+}
 export function entrypointHref(entrypoint) {
+    if (entrypoint.deployment === undefined) {
+        return entrypoint.path;
+    }
     const url = new URL(entrypoint.deployment.href);
     url.pathname = entrypoint.path === "" ? "/" : entrypoint.path;
     return url.href.replace(/\/$/, "");

package/dist/config/env.cascade.d.ts

@@ -2,10 +2,8 @@
 export type EnvRecord = Readonly<Record<string, string>>;
 /** The process environment as Node types it: values may be `undefined`. */
 export type ProcessEnvInput = Readonly<Record<string, string | undefined>>;
-/** The mode used when neither an explicit mode nor `NODE_ENV` supplies one. */
-export declare const DEFAULT_ENV_MODE = "development";
 export type EnvFileReader = (filePath: string) => string | undefined;
-export interface EnvCascadeInput {
+interface EnvCascadeInput {
     /** The directory the five candidates are looked up in. */
     readonly directory: string;
     /** A snapshot of the process environment. Never mutated. */
@@ -31,10 +29,7 @@ export declare class AvEnvFileError extends Error {
 }
 /** The four file candidates for a mode, highest precedence first. */
 export declare function envCascadeCandidates(mode: string): readonly string[];
-export declare function resolveEnvMode(processEnv: ProcessEnvInput, explicit?: string): string;
 export declare function resolveEnvCascade(input: EnvCascadeInput): EnvCascadeResolution;
-/** Reads a candidate from disk; `ENOENT` alone means "not there". */
-export declare function readEnvFileFromDisk(filePath: string): string | undefined;
 /**
  * Parses one file's content. A file whose content holds a line the parser would
  * silently discard is malformed: the user wrote something they expect to take
@@ -50,3 +45,4 @@ export declare function parseEnvFile(filePath: string, content: string): Record<
  * spanning lines — or, when there is none, to the end of its own line.
  */
 export declare function firstDiscardedLine(content: string): number | undefined;
+export {};

package/dist/config/env.cascade.js

@@ -1,7 +1,7 @@
 import { readFileSync } from "node:fs";
 import path from "node:path";
 import { parseEnv } from "node:util";
-export const DEFAULT_ENV_MODE = "development";
+const DEFAULT_ENV_MODE = "development";
 export class AvEnvFileError extends Error {
     filePath;
     reason;
@@ -15,7 +15,7 @@ export class AvEnvFileError extends Error {
 export function envCascadeCandidates(mode) {
     return [`.env.${mode}.local`, `.env.${mode}`, ".env.local", ".env"];
 }
-export function resolveEnvMode(processEnv, explicit) {
+function resolveEnvMode(processEnv, explicit) {
     if (explicit !== undefined && explicit !== "")
         return explicit;
     const nodeEnv = processEnv.NODE_ENV;
@@ -44,7 +44,7 @@ export function resolveEnvCascade(input) {
     }
     return { mode, env: Object.freeze(env), candidates, loaded };
 }
-export function readEnvFileFromDisk(filePath) {
+function readEnvFileFromDisk(filePath) {
     try {
         return readFileSync(filePath, "utf8");
     }

package/dist/config/module-style.resolver.d.ts

@@ -1,12 +1,10 @@
-import type { TsConfigJsonResolved } from "get-tsconfig";
-import type { ClientModuleStyle, ImportFileExtension, ModuleFormat } from "../emit/module-style.interface.js";
-import { type LocatedTsconfig } from "./tsconfig.locator.js";
+import type { ClientModuleStyle } from "../emit/module-style.interface.js";
 /** What the run follows, and where it read it from. */
 export interface ResolvedModuleStyle extends ClientModuleStyle {
     /** The tsconfig the style was inferred from. */
     readonly tsconfig: string;
 }
-export interface ModuleStyleInput {
+interface ModuleStyleInput {
     /** The absolute `generateAt`. */
     readonly generateAt: string;
     /** The generated entry file, absolute: the file the project must include. */
@@ -23,5 +21,4 @@ export interface ModuleStyleInput {
 export declare function resolveModuleStyle(input: ModuleStyleInput): ResolvedModuleStyle;
 /** The refusal of a project with no tsconfig: a JavaScript project. */
 export declare function noTsconfigRefusal(generateAt: string): string;
-export declare function importFileExtensionOf(config: TsConfigJsonResolved): ImportFileExtension;
-export declare function moduleFormatOf(tsconfig: LocatedTsconfig, generateAt: string): ModuleFormat;
+export {};

package/dist/config/module-style.resolver.js

@@ -20,7 +20,7 @@ export function noTsconfigRefusal(generateAt) {
         "(`npx tsc --init` writes one), or, if it has one this search does not find, name it with `tsconfigFile` " +
         "in your framework.client config. Nothing was written.");
 }
-export function importFileExtensionOf(config) {
+function importFileExtensionOf(config) {
     const options = config.compilerOptions;
     if (options?.allowImportingTsExtensions ||
         options?.rewriteRelativeImportExtensions) {
@@ -32,7 +32,7 @@ export function importFileExtensionOf(config) {
         ? ""
         : "js";
 }
-export function moduleFormatOf(tsconfig, generateAt) {
+function moduleFormatOf(tsconfig, generateAt) {
     const module = tsconfig.config.compilerOptions?.module?.toLowerCase();
     if (module === undefined || module === "") {
         return "esm";