@flytedesk/app-kit 3.2.3 → 4.0.0

package/README.md

@@ -13,6 +13,8 @@ Five subpath modules, one npm package:
 - `@flytedesk/app-kit/rate-limit` — request rate-limiting and quota enforcement.
 - `@flytedesk/app-kit/profile` — user profile and preferences management.
 - `@flytedesk/app-kit/flags` — feature flags and A/B testing.
+- `@flytedesk/app-kit/postgres` — Postgres helpers shared by every app: transaction-scoped
+  advisory locks (`acquireAdvisoryLock`, `isAdvisoryLockTimeout`).
 
 Status: **bootstrapping.** Both modules are placeholders. See media-planner's published
 "Media Planner Backend" architecture doc for the full design (DEC-25 through DEC-34) and
@@ -36,22 +38,140 @@ every authenticated request to every consumer of this package. Sign-out still co
 locally (cookies cleared, refresh-token family revoked) even when the IdP-side
 revocation call itself times out.
 
+**An outage is never a sign-out (4.0).** A session is revoked only on a verdict:
+flytedesk-id refuses the session's token (a 401/403 from a resource endpoint, or
+`invalid_grant` from `/token`), `onAuthorizeUser` returns `null`, or the IdP session
+row is gone. Anything that merely prevents a decision — flytedesk-id down or timing
+out, `/token` refusing THIS APP's credentials (`invalid_client`: a bad or rotated client
+secret), a lock timeout, any `AuthStore` error, a *throwing* `onAuthorizeUser` — answers
+**503** with nothing revoked, end to end:
+
+- `POST {routePrefix}/refresh` answers 503 with the cookie untouched, so the same
+  cookie works again once the dependency recovers.
+- Every authenticated request does too: `requireAuth`/`requirePermission`, `GET
+  {routePrefix}/me`, `GET {routePrefix}/apps` and the `@flytedesk/app-kit/flags` and
+  `@flytedesk/app-kit/profile` routes answer 503 (never the 401 that means "signed out")
+  when `request.authUnavailable` is set — all through one shared guard.
+- `GET {routePrefix}/apps` is the app-switcher feed: once `requireAuth` has verified the
+  session, a failure of the feed itself (flytedesk-id's `/me/apps` or `/token`, or the
+  store) is **502 `apps_unavailable`**, not an auth 503 — the session is fine.
+- The body is always `{ error, code }` with `code` one of `AUTH_UNAVAILABLE_CODES`:
+  `idp_unavailable`, `auth_store_unavailable` or `authorization_hook_failed`.
+- The browser client raises `AuthUnavailableError` (an `ApiRequestError`) for it and
+  never runs the auth recovery; `onAuthUnavailable(listener)` announces it. The
+  automatic refresh treats only the plugin's 401 as "signed out": a network error, its
+  10s deadline, a proxy's 502/504 or any other non-200 is an `AuthUnavailableError` too
+  (code `auth_unreachable`). `useAuthSession` keeps the session in
+  `status: "unavailable"` (with the last verified `user` — display-only, not a verified
+  identity — and `retryInMs`) and re-verifies by itself with jittered exponential
+  backoff (ceilings 1s, 2s, 4s, … capped at 30s, each delay drawn from the ceiling's
+  upper half) until the server answers — render it as "reconnecting", never as a
+  sign-in screen. A failing `/apps` never blocks the session: `apps` is `[]` and
+  `appsError` says why.
+
+**Sign-out always clears the cookie (4.0).** `POST {routePrefix}/logout` clears the
+refresh cookie in a `finally`, attempts each store step (revoke the family, look up and
+delete the IdP session) independently, and answers `502 logout_store_failed` (logged)
+if any step failed.
+
+**Replays of ended families are not reuse (4.0).** A presented refresh token that was
+*rotated* is a concurrent-tab race inside `refreshReuseGraceMs` and reuse outside it
+(`reuse_detected`, family revoked). A token revoked for any other reason — its family
+was signed out, rejected, or already revoked for reuse — answers 401 with the cookie
+cleared, and is neither revoked again nor reported as reuse.
+
+**The `AuthStore` contract (4.0).** Every method, and what it must guarantee, is
+documented on `AuthStore` in `src/auth/types.ts`; the migration from 3.x is in
+`CHANGELOG.md` under 4.0.0. The two guarantees that matter most:
+
+- `withIdpSessionLock(sessionId, fn)` calls `fn(locked)` with a store bound to the
+  lock. A Postgres store takes the lock with `@flytedesk/app-kit/postgres`'s
+  `acquireAdvisoryLock` inside one interactive transaction and must run `locked`'s
+  queries on that same transaction. Using its pooled client instead needs a second
+  connection per lock holder, and a burst of stale-session refreshes the size of the
+  pool deadlocks it (3.x signed every one of those users out).
+- `rotateRefreshToken(presentedId, successor, rotatedAt)` revokes the presented token
+  (reason `"rotated"`, only if still live) and inserts its successor in ONE transaction,
+  returning whether it won.
+- ONE clock: every time the plugin compares (`expiresAt`, `revocation.at`) comes from the
+  app's clock — compared against the clock read at the request's start, and stamped from
+  it at the moment of the store write (`rotatedAt`, `revokedAt`). A store persists it
+  exactly as given and never stamps it with the database's `now()`. Multiple app
+  instances are assumed to run NTP-synced clocks.
+- `rotateRefreshToken` and `revokeFamily` take the same per-family lock. Under READ
+  COMMITTED a family revocation cannot see a successor a concurrent rotation has not
+  committed yet, and without the lock that successor survives as a live token of a
+  signed-out family.
+
+**Residual risk: a lost IdP refresh token.** flytedesk-id rotates its refresh token the
+moment it answers a refresh; until the store's lock transaction commits, the plugin's
+memory holds the only copy of the new one. If `updateIdpSession` or the commit fails in
+that window, the next refresh of that session gets `invalid_grant` and the user has to
+sign in again. The window can't be closed from this side (the IdP call can't join the
+transaction); the plugin persists the new token before anything else that can fail,
+`fn` never throws an IdP outcome (it returns it, and the plugin throws only once
+`withIdpSessionLock` has resolved, so an unusable IdP answer never rolls the persisted
+token back), and a store must not do more work in the transaction after `fn` returns. Details on
+`AuthStore.withIdpSessionLock`.
+
+`@flytedesk/app-kit/auth/testing` ships `MemoryAuthStore` (an in-memory store that
+honours the whole contract) and `FakeIdp`, whose controls cover the negative paths:
+`setForceSubjectMismatch`, `setForceInvalidClient`, an identity's `emailVerified: false`,
+`setMyAppsFailureStatus`, `setForceRefreshFailure`, the `setHang*Ms` family, and
+`refreshGrantCount`.
+
+**The silent-resume page is hardened (4.0).** The `prompt=none` callback's postMessage
+page carries only a fixed `SilentAuthDetailCode` (anything unknown becomes `"other"`),
+serializes its payload so `<`, `>`, `&`, U+2028 and U+2029 can't escape the inline
+script, and is served with
+`Content-Security-Policy: default-src 'none'; script-src 'sha256-…'; frame-ancestors <postLoginRedirect origin>; base-uri 'none'`
+plus `X-Content-Type-Options: nosniff`.
+
+`onSignIn(profile, request, context)` receives `context.mode`: `"silent"` for a
+hidden-iframe resume, `"interactive"` for a visible sign-in.
+
 **Residual risk in the refresh-token grace window (RFC 9700 §4.14.2).** `POST
 {routePrefix}/refresh` rotates the presented refresh token on every call and treats a
-second presentation of an already-rotated token as a legitimate concurrent-tab race
-(401, nothing revoked) rather than reuse, as long as it arrives within
-`refreshReuseGraceMs` (default 20s) of the rotation. This is deliberate — two browser
-tabs sharing one cookie jar can otherwise trip false-positive reuse detection — but it
-means that within that same window, an attacker who has obtained a copy of a
-not-yet-presented refresh token and wins the race against the legitimate browser is
-**indistinguishable from a same-device two-tab race**: both look like "a token was
-rotated, then its predecessor was presented again shortly after." A presentation
-**outside** the window, or of a token that was never rotated at all, is always treated
-as reuse and revokes the whole family. Consumers who need a tighter bound can lower
+second presentation of the IMMEDIATELY previous token as a concurrent-tab race — or a
+browser whose refresh response was lost and still holds the old cookie — rather than
+reuse, as long as it arrives within `refreshReuseGraceMs` (default 20s) of the rotation.
+Rotation is deterministic (an HMAC of the presented row's server-side id and the token,
+under a key derived from `accessTokenSecret`), so such a presentation is answered with
+the SAME successor the first one issued, when that successor is still the family's live
+token, and nothing is revoked. Only one hop is honoured (as Auth0's reuse interval):
+tabs share one cookie jar, so only an in-flight request can carry a stale token, and a
+token two or more rotations back is reuse even inside the window. This is deliberate —
+two browser tabs sharing one cookie jar can otherwise trip false-positive reuse
+detection — but it means that within that same window, an attacker who has obtained a
+copy of the immediately previous refresh token is **indistinguishable from a same-device
+two-tab race or a lost response** — and, like them, is handed the family's live token.
+Every such resume is logged at `warn` with the presenting client's IP and User-Agent
+beside the ones the successor was issued to. A presentation **outside** the window, or
+of an older token, is always treated as reuse and revokes the whole family. Consumers who need a tighter bound can lower
 `refreshReuseGraceMs`, trading some tolerance for slow concurrent-tab requests for a
 narrower attack window; it cannot be set to zero without reintroducing the false-positive
 two-tab problem this window exists to solve.
 
+**Recovering from a leaked `accessTokenSecret` (4.0).** The secret signs access tokens and
+keys refresh-token rotation (it must be at least 32 bytes; registration refuses anything
+shorter). A refresh token's successor also depends on its row's server-side id, so a
+leaked secret plus an old raw token does not let anyone compute a family's current token —
+but anyone who has the secret can forge access tokens, and anyone holding a family's
+CURRENT refresh token keeps it. Recover in two steps, together:
+
+1. **Rotate the secret** on every instance. Access tokens signed with the old one stop
+   verifying at once (the browser client refreshes transparently).
+2. **Revoke every refresh family**, so no refresh token issued before the rotation still
+   works: in your store, e.g. `UPDATE refresh_tokens SET revoked_at = $appNow,
+   revoked_reason = 'signed_out' WHERE revoked_at IS NULL` (with `$appNow` from the app's
+   clock). Every user signs in again.
+
+**During a rolling secret change**, instances briefly disagree on the secret. A normal
+refresh works on any instance, but an in-grace second presentation of a just-rotated
+token (a lost response, a concurrent tab) that lands on an instance with the OTHER secret
+cannot re-derive the successor and answers 401 — the client treats that browser as signed
+out. Keep the change short, or drain traffic to one secret at a time.
+
 **Failed interactive sign-ins land back in the app, not on a raw JSON error page.**
 `signInUrl` (`FlytedeskAuthOptions`, required) is where `GET {routePrefix}/callback`
 redirects an INTERACTIVE (not `prompt=none`) sign-in failure — idp_error (including

package/dist/auth/client/httpClient.d.ts

@@ -10,7 +10,7 @@
  * future change here ever needs one, it belongs in the server (`../plugin.js`) or in a
  * new Node-only module instead.
  */
-import { type ApiErrorBody } from "../shared-types.js";
+import { type ApiErrorBody, type AuthUnavailableCode } from "../shared-types.js";
 /** `expires_in`-free deadline for every call this client makes, unless a caller passes
  *  its own `deadlineMs` — the same `AUTH_REQUEST_DEADLINE_MS` (`../shared-types.js`) the
  *  server plugin's default `refreshReuseGraceMs` is sized around (2x this), so the two
@@ -26,6 +26,38 @@ export declare class ApiRequestError extends Error {
     body: ApiErrorBody & Record<string, unknown>;
     constructor(status: number, body: ApiErrorBody & Record<string, unknown>);
 }
+/**
+ * The code an AuthUnavailableError carries when the automatic `POST {routePrefix}/refresh`
+ * produced no decision at all (AK-23, L-c): no response (a network error), no response
+ * within DEFAULT_REQUEST_DEADLINE_MS, or a response the plugin did not decide (an
+ * infrastructure 502/504, a 503 without an `AUTH_UNAVAILABLE_CODES` code — any status
+ * other than 200 or 401). `status` is the response's, or 0 when there was none.
+ */
+export declare const AUTH_UNREACHABLE_CODE = "auth_unreachable";
+/** Every `code` an AuthUnavailableError can carry: the server's own
+ *  `AUTH_UNAVAILABLE_CODES`, or AUTH_UNREACHABLE_CODE when the refresh got no decision. */
+export type AuthUnavailableErrorCode = AuthUnavailableCode | typeof AUTH_UNREACHABLE_CODE;
+/**
+ * AK-23: the server could not DECIDE whether this session is still authorized —
+ * flytedesk-id or the app's AuthStore is down, or its authorization hook failed (a 503
+ * carrying one of `AUTH_UNAVAILABLE_CODES`) — or the automatic refresh reached no
+ * decision at all (`AUTH_UNREACHABLE_CODE`). Transient, and NOT a sign-out: the session
+ * (its refresh cookie) is intact and the same request can succeed once the dependency
+ * recovers. This client never runs the auth recovery for it; `useAuthSession` keeps the
+ * session and retries with backoff (its `"unavailable"` status). A subclass of
+ * ApiRequestError, so existing `instanceof ApiRequestError` handling still sees it.
+ */
+export declare class AuthUnavailableError extends ApiRequestError {
+    code: AuthUnavailableErrorCode;
+    constructor(status: number, body: ApiErrorBody & Record<string, unknown> & {
+        code: AuthUnavailableErrorCode;
+    });
+}
+type AuthUnavailableListener = (error: AuthUnavailableError) => void;
+/** Subscribes to every AuthUnavailableError this client raises (AK-23) — how a session
+ *  layer learns that an ordinary request hit an outage, so it can show "reconnecting"
+ *  instead of treating the user as signed out. Returns the unsubscribe function. */
+export declare function onAuthUnavailable(listener: AuthUnavailableListener): () => void;
 /** A request that missed its deadline (see withDeadline). */
 export declare class RequestDeadlineError extends Error {
     constructor(what: string, ms: number);
@@ -52,6 +84,25 @@ export interface AuthRecovery {
  *  invalidates its session state. Left entirely unset is fine — decodeWithAuthRetry
  *  then just reports the second 401 as a failure, with no recovery attempt. */
 export declare function setAuthRecovery(recovery: AuthRecovery): () => void;
+/**
+ * Runs — or joins, when one is already in flight — THE one `POST {routePrefix}/refresh`,
+ * and resolves the new access token (also stored via setAccessToken). Single-flighted and
+ * always deadline-bound: every caller that 401s, and useAuthSession's own loads, share
+ * this one refresh — the refresh cookie rotates on every call, so two concurrent
+ * refreshes presenting one cookie would race, and a refresh that never answered would
+ * stall them all.
+ *
+ * AK-23 (L-c): only the plugin's verdict signs anyone out. A 401 — the one answer the
+ * plugin gives a refresh it refuses — resolves `null` ("no new token"), which
+ * sendAndDecode treats as the session being gone. Every other outcome rejects with
+ * AuthUnavailableError, shared by every waiting caller, so no caller ever runs the auth
+ * recovery (the sign-out path) over an outage: the plugin's own 503 "could not decide",
+ * and an outcome that is no decision at all (AUTH_UNREACHABLE_CODE) — a network error,
+ * the deadline (the server's `/refresh` can legitimately outlast it: a contended
+ * session lock plus a slow flytedesk-id `/token` and authorization call), or a status
+ * the plugin never answers `/refresh` with, such as a proxy's 502/504.
+ */
+export declare function refreshAccessToken(): Promise<string | null>;
 export interface RequestOptions {
     method?: "GET" | "POST" | "PATCH" | "PUT" | "DELETE";
     body?: unknown;
@@ -85,3 +136,30 @@ export declare function apiRequest<T>(path: string, options?: RequestOptions): P
 export declare function apiUpload<T>(path: string, formData: FormData, options?: {
     skipAuthRetry?: boolean;
 }): Promise<T>;
+export interface ApiDownloadOptions {
+    query?: RequestOptions["query"];
+    /** Bounds the whole call exactly like RequestOptions.deadlineMs — first attempt, any
+     *  refresh it waits on, the retry and the blob read. */
+    deadlineMs?: number;
+    /** An external abort signal (e.g. a component's cleanup) — aborts the in-flight
+     *  fetch immediately, independent of deadlineMs. */
+    signal?: AbortSignal;
+    skipAuthRetry?: boolean;
+}
+export interface ApiDownloadResult {
+    blob: Blob;
+    /** Parsed from Content-Disposition (RFC 6266 / RFC 5987); undefined when the
+     *  response carries neither a filename nor filename* directive. */
+    filename: string | undefined;
+    contentType: string;
+}
+/** Sibling to apiRequest for downloading a file through the SAME request pipeline:
+ *  URL/query building, credentials, deadline, abort, and the 401 -> refresh ->
+ *  retry-once dance (see sendWithAuthRetry) — but decodes the body as a Blob instead
+ *  of JSON, and returns the filename Content-Disposition names for it. */
+export declare function apiDownload(path: string, options?: ApiDownloadOptions): Promise<ApiDownloadResult>;
+/** Triggers a browser "Save As" for an already-fetched blob (e.g. from apiDownload) —
+ *  a transient off-DOM anchor is the standard way to do this without navigating away.
+ *  No-op outside a browser (no `document`). */
+export declare function saveBlob(blob: Blob, filename: string): void;
+export {};

package/dist/auth/client/httpClient.js

@@ -10,7 +10,7 @@
  * future change here ever needs one, it belongs in the server (`../plugin.js`) or in a
  * new Node-only module instead.
  */
-import { AUTH_REQUEST_DEADLINE_MS, AUTH_ROUTE_PREFIX, authRoutePath } from "../shared-types.js";
+import { AUTH_REQUEST_DEADLINE_MS, AUTH_ROUTE_PREFIX, AUTH_UNAVAILABLE_CODES, authRoutePath, } from "../shared-types.js";
 /** `expires_in`-free deadline for every call this client makes, unless a caller passes
  *  its own `deadlineMs` — the same `AUTH_REQUEST_DEADLINE_MS` (`../shared-types.js`) the
  *  server plugin's default `refreshReuseGraceMs` is sized around (2x this), so the two
@@ -33,6 +33,60 @@ export class ApiRequestError extends Error {
         this.body = body;
     }
 }
+/**
+ * The code an AuthUnavailableError carries when the automatic `POST {routePrefix}/refresh`
+ * produced no decision at all (AK-23, L-c): no response (a network error), no response
+ * within DEFAULT_REQUEST_DEADLINE_MS, or a response the plugin did not decide (an
+ * infrastructure 502/504, a 503 without an `AUTH_UNAVAILABLE_CODES` code — any status
+ * other than 200 or 401). `status` is the response's, or 0 when there was none.
+ */
+export const AUTH_UNREACHABLE_CODE = "auth_unreachable";
+/**
+ * AK-23: the server could not DECIDE whether this session is still authorized —
+ * flytedesk-id or the app's AuthStore is down, or its authorization hook failed (a 503
+ * carrying one of `AUTH_UNAVAILABLE_CODES`) — or the automatic refresh reached no
+ * decision at all (`AUTH_UNREACHABLE_CODE`). Transient, and NOT a sign-out: the session
+ * (its refresh cookie) is intact and the same request can succeed once the dependency
+ * recovers. This client never runs the auth recovery for it; `useAuthSession` keeps the
+ * session and retries with backoff (its `"unavailable"` status). A subclass of
+ * ApiRequestError, so existing `instanceof ApiRequestError` handling still sees it.
+ */
+export class AuthUnavailableError extends ApiRequestError {
+    constructor(status, body) {
+        super(status, body);
+        this.name = "AuthUnavailableError";
+    }
+}
+function isAuthUnavailableCode(code) {
+    return AUTH_UNAVAILABLE_CODES.includes(code);
+}
+const authUnavailableListeners = new Set();
+/** Subscribes to every AuthUnavailableError this client raises (AK-23) — how a session
+ *  layer learns that an ordinary request hit an outage, so it can show "reconnecting"
+ *  instead of treating the user as signed out. Returns the unsubscribe function. */
+export function onAuthUnavailable(listener) {
+    authUnavailableListeners.add(listener);
+    return () => {
+        authUnavailableListeners.delete(listener);
+    };
+}
+function raiseAuthUnavailable(error) {
+    for (const listener of authUnavailableListeners)
+        listener(error);
+    return error;
+}
+/** The one mapping from an error response to the error this client throws: a
+ *  "could not decide" 503 becomes AuthUnavailableError (and is announced), anything
+ *  else an ApiRequestError. */
+async function errorFromResponse(res) {
+    const body = (await res
+        .json()
+        .catch(() => ({ error: res.statusText, code: "unknown" })));
+    if (res.status === 503 && isAuthUnavailableCode(body.code)) {
+        return raiseAuthUnavailable(new AuthUnavailableError(503, { ...body, code: body.code }));
+    }
+    return new ApiRequestError(res.status, body);
+}
 /** A request that missed its deadline (see withDeadline). */
 export class RequestDeadlineError extends Error {
     constructor(what, ms) {
@@ -76,8 +130,14 @@ export function setAuthRecovery(recovery) {
  *  fetch, and any body read on it, is cancelled) and the returned promise rejects with
  *  a RequestDeadlineError — the rejection does not depend on whatever `run` awaits
  *  honouring the signal, so this settles no matter what. */
-async function withDeadline(what, ms, run) {
+async function withDeadline(what, ms, run, externalSignal) {
     const controller = new AbortController();
+    if (externalSignal) {
+        if (externalSignal.aborted)
+            controller.abort(externalSignal.reason);
+        else
+            externalSignal.addEventListener("abort", () => controller.abort(externalSignal.reason), { once: true });
+    }
     let timer;
     const deadline = new Promise((_, reject) => {
         timer = setTimeout(() => {
@@ -93,11 +153,33 @@ async function withDeadline(what, ms, run) {
         clearTimeout(timer);
     }
 }
-/** Single-flighted, and always deadline-bound: every caller that 401s shares this one
- *  refresh, so a refresh that never answered would stall all of them. Any failure — a
- *  non-2xx, a network error, the deadline — resolves null ("no new token"), which
- *  sendAndDecode treats exactly like a refused refresh. */
-async function refreshAccessToken() {
+/** The AuthUnavailableError (announced to onAuthUnavailable listeners) for a refresh
+ *  that reached no decision — see AUTH_UNREACHABLE_CODE. */
+function refreshUnreachable(status, cause) {
+    return raiseAuthUnavailable(new AuthUnavailableError(status, {
+        error: `Sign-in could not be verified right now — ${cause}`,
+        code: AUTH_UNREACHABLE_CODE,
+    }));
+}
+/**
+ * Runs — or joins, when one is already in flight — THE one `POST {routePrefix}/refresh`,
+ * and resolves the new access token (also stored via setAccessToken). Single-flighted and
+ * always deadline-bound: every caller that 401s, and useAuthSession's own loads, share
+ * this one refresh — the refresh cookie rotates on every call, so two concurrent
+ * refreshes presenting one cookie would race, and a refresh that never answered would
+ * stall them all.
+ *
+ * AK-23 (L-c): only the plugin's verdict signs anyone out. A 401 — the one answer the
+ * plugin gives a refresh it refuses — resolves `null` ("no new token"), which
+ * sendAndDecode treats as the session being gone. Every other outcome rejects with
+ * AuthUnavailableError, shared by every waiting caller, so no caller ever runs the auth
+ * recovery (the sign-out path) over an outage: the plugin's own 503 "could not decide",
+ * and an outcome that is no decision at all (AUTH_UNREACHABLE_CODE) — a network error,
+ * the deadline (the server's `/refresh` can legitimately outlast it: a contended
+ * session lock plus a slow flytedesk-id `/token` and authorization call), or a status
+ * the plugin never answers `/refresh` with, such as a proxy's 502/504.
+ */
+export async function refreshAccessToken() {
     if (!refreshPromise) {
         const refreshPath = authRoutePath(AUTH_ROUTE_PREFIX, "refresh");
         refreshPromise = withDeadline(`POST ${refreshPath}`, DEFAULT_REQUEST_DEADLINE_MS, async (signal) => {
@@ -106,13 +188,23 @@ async function refreshAccessToken() {
                 credentials: "include",
                 signal,
             });
-            if (!res.ok)
+            if (res.status === 401)
                 return null;
+            if (!res.ok) {
+                const error = await errorFromResponse(res);
+                if (error instanceof AuthUnavailableError)
+                    throw error;
+                throw refreshUnreachable(res.status, `the server answered ${res.status}`);
+            }
             const body = (await res.json());
             setAccessToken(body.accessToken);
             return body.accessToken;
         })
-            .catch(() => null)
+            .catch((err) => {
+            if (err instanceof AuthUnavailableError)
+                throw err;
+            throw refreshUnreachable(0, err instanceof RequestDeadlineError ? "no answer in time" : "the server could not be reached");
+        })
             .finally(() => {
             refreshPromise = null;
         });
@@ -154,12 +246,20 @@ async function sendAndDecode(label, doFetch, options) {
         return decodeWithAuthRetry(doFetch, options);
     return withDeadline(label, deadlineMs, (signal) => decodeWithAuthRetry(doFetch, options, signal));
 }
-async function decodeWithAuthRetry(doFetch, { skipAuthRetry, ownsAuthRecovery }, signal) {
+/** The shared tail of every transport this client offers: fires `doFetch`,
+ *  transparently retries once after a refresh on 401 (unless skipped), and once more
+ *  after the shared auth recovery if that still 401s (see setAuthRecovery) — then
+ *  throws the decoded error on any non-2xx. Returns the successful raw Response so
+ *  each transport (JSON body, blob download) can decode it its own way; this is the
+ *  ONE place the auth-retry dance lives, so it can't drift between them. */
+async function sendWithAuthRetry(doFetch, { skipAuthRetry, ownsAuthRecovery }, signal) {
     // Who this request is being sent as — the only identity a recovery may replay it for.
     const recovery = authRecovery;
     const sentAs = recovery?.principal() ?? null;
     let res = await doFetch(signal);
     if (res.status === 401 && !skipAuthRetry) {
+        // Rejects with AuthUnavailableError on an outage (AK-23) — straight out of this
+        // call, past the recovery below: an outage is not a sign-out.
         const refreshed = await refreshAccessToken();
         // The shared refresh is not cancelled by this call's deadline (other callers may
         // still want it) — but a call that has already missed its deadline must not act on
@@ -186,12 +286,12 @@ async function decodeWithAuthRetry(doFetch, { skipAuthRetry, ownsAuthRecovery },
             signal?.throwIfAborted();
         }
     }
-    if (!res.ok) {
-        const errorBody = (await res
-            .json()
-            .catch(() => ({ error: res.statusText, code: "unknown" })));
-        throw new ApiRequestError(res.status, errorBody);
-    }
+    if (!res.ok)
+        throw await errorFromResponse(res);
+    return res;
+}
+async function decodeWithAuthRetry(doFetch, options, signal) {
+    const res = await sendWithAuthRetry(doFetch, options, signal);
     if (res.status === 204)
         return undefined;
     return (await res.json());
@@ -231,4 +331,73 @@ export async function apiUpload(path, formData, options = {}) {
     });
     return sendAndDecode(`POST ${path}`, doFetch, { skipAuthRetry });
 }
+/** RFC 6266 filename from a `Content-Disposition` header, preferring the RFC 5987
+ *  extended `filename*=charset'lang'value` form (percent-decoded) over the plain
+ *  `filename="..."` form when both are present — the extended form is the one that can
+ *  actually carry non-ASCII names. `undefined` when the header is absent or carries
+ *  neither form. */
+function parseContentDispositionFilename(header) {
+    if (!header)
+        return undefined;
+    const extended = /filename\*\s*=\s*([^;]+)/i.exec(header);
+    if (extended) {
+        // charset'lang'value — charset is always UTF-8 in practice and lang is usually
+        // empty; only the value is ever meaningful to decode.
+        const value = extended[1].trim().replace(/^"|"$/g, "");
+        const parts = value.split("'");
+        if (parts.length === 3) {
+            try {
+                return decodeURIComponent(parts[2]);
+            }
+            catch {
+                // Malformed percent-encoding — fall through to the plain form below.
+            }
+        }
+    }
+    const plain = /filename\s*=\s*"?([^";]+)"?/i.exec(header);
+    return plain ? plain[1] : undefined;
+}
+/** Sibling to apiRequest for downloading a file through the SAME request pipeline:
+ *  URL/query building, credentials, deadline, abort, and the 401 -> refresh ->
+ *  retry-once dance (see sendWithAuthRetry) — but decodes the body as a Blob instead
+ *  of JSON, and returns the filename Content-Disposition names for it. */
+export async function apiDownload(path, options = {}) {
+    const { query, deadlineMs, signal, skipAuthRetry } = options;
+    const doFetch = async (fetchSignal) => fetch(buildUrl(path, query), {
+        method: "GET",
+        credentials: "include",
+        headers: {
+            ...(accessToken ? { Authorization: `Bearer ${accessToken}` } : {}),
+        },
+        signal: fetchSignal,
+    });
+    const decode = async (res) => {
+        const blob = await res.blob();
+        const contentType = res.headers.get("content-type")?.split(";")[0]?.trim() ?? "application/octet-stream";
+        const filename = parseContentDispositionFilename(res.headers.get("content-disposition"));
+        return { blob, filename, contentType };
+    };
+    const run = async (fetchSignal) => decode(await sendWithAuthRetry(doFetch, { skipAuthRetry }, fetchSignal));
+    if (deadlineMs === undefined)
+        return run(signal);
+    return withDeadline(`GET ${path}`, deadlineMs, run, signal);
+}
+/** Triggers a browser "Save As" for an already-fetched blob (e.g. from apiDownload) —
+ *  a transient off-DOM anchor is the standard way to do this without navigating away.
+ *  No-op outside a browser (no `document`). */
+export function saveBlob(blob, filename) {
+    if (typeof document === "undefined")
+        return;
+    const urlStatics = URL;
+    const url = urlStatics.createObjectURL(blob);
+    try {
+        const anchor = document.createElement("a");
+        anchor.href = url;
+        anchor.download = filename;
+        anchor.click();
+    }
+    finally {
+        urlStatics.revokeObjectURL(url);
+    }
+}
 //# sourceMappingURL=httpClient.js.map

package/dist/auth/client/httpClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"httpClient.js","sourceRoot":"","sources":["../../../src/auth/client/httpClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,aAAa,EAAqB,MAAM,oBAAoB,CAAC;AAUnH;;;8EAG8E;AAC9E,MAAM,CAAC,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AAEpE,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,IAAI,CAAS;IACb,KAAK,CAAU;IACf,MAAM,CAAS;IACf;;qDAEiD;IACjD,IAAI,CAAyC;IAC7C,YAAY,MAAc,EAAE,IAA4C;QACtE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,6DAA6D;AAC7D,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,IAAY,EAAE,EAAU;QAClC,KAAK,CAAC,GAAG,IAAI,4BAA4B,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,IAAI,WAAW,GAAkB,IAAI,CAAC;AACtC,IAAI,cAAc,GAAkC,IAAI,CAAC;AACzD,IAAI,OAAO,GAAG,SAAS,CAAC;AAExB,MAAM,UAAU,kBAAkB,CAAC,IAAyB;IAC1D,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAoB;IACjD,WAAW,GAAG,KAAK,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;sBACsB;AACtB,MAAM,UAAU,UAAU;IACxB,OAAO,OAAO,CAAC;AACjB,CAAC;AAQD,IAAI,YAAY,GAAwB,IAAI,CAAC;AAE7C;;;;;;+EAM+E;AAC/E,MAAM,UAAU,eAAe,CAAC,QAAsB;IACpD,YAAY,GAAG,QAAQ,CAAC;IACxB,OAAO,GAAG,EAAE;QACV,IAAI,YAAY,KAAK,QAAQ;YAAE,YAAY,GAAG,IAAI,CAAC;IACrD,CAAC,CAAC;AACJ,CAAC;AAED;;;4DAG4D;AAC5D,KAAK,UAAU,YAAY,CACzB,IAAY,EACZ,EAAU,EACV,GAAwC;IAExC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,KAAgD,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QAChD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,MAAM,MAAM,GAAG,IAAI,oBAAoB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAClD,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACzB,MAAM,CAAC,MAAM,CAAC,CAAC;QACjB,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAChE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;;2DAG2D;AAC3D,KAAK,UAAU,kBAAkB;IAC/B,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,WAAW,GAAG,aAAa,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;QAChE,cAAc,GAAG,YAAY,CAC3B,QAAQ,WAAW,EAAE,EACrB,2BAA2B,EAC3B,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,GAAG,WAAW,EAAE,EAAE;gBAClD,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,SAAS;gBACtB,MAAM;aACP,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC3D,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACjC,OAAO,IAAI,CAAC,WAAW,CAAC;QAC1B,CAAC,CACF;aACE,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;aACjB,OAAO,CAAC,GAAG,EAAE;YACZ,cAAc,GAAG,IAAI,CAAC;QACxB,CAAC,CAAC,CAAC;IACP,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AA0BD;gFACgF;AAChF,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,KAA+B;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,OAAO,GAAG,IAAI,EACd,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAC5E,CAAC;IACF,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE;gBAAE,SAAS;YAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;;gBACnF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,oFAAoF;IACpF,oFAAoF;IACpF,4CAA4C;IAC5C,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC;AAC7E,CAAC;AAID;;;;;kFAKkF;AAClF,KAAK,UAAU,aAAa,CAAI,KAAa,EAAE,OAAgB,EAAE,OAAoB;IACnF,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAC/B,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,mBAAmB,CAAI,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9E,OAAO,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAI,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AACvG,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,OAAgB,EAChB,EAAE,aAAa,EAAE,gBAAgB,EAAe,EAChD,MAAoB;IAEpB,sFAAsF;IACtF,MAAM,QAAQ,GAAG,YAAY,CAAC;IAC9B,MAAM,MAAM,GAAG,QAAQ,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC;IAC7C,IAAI,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAEhC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,MAAM,kBAAkB,EAAE,CAAC;QAC7C,iFAAiF;QACjF,mFAAmF;QACnF,8EAA8E;QAC9E,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,IAAI,SAAS;YAAE,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,4EAA4E;YAC5E,6EAA6E;YAC7E,6DAA6D;YAC7D,IAAI,QAAQ,IAAI,gBAAgB,EAAE,CAAC;gBACjC,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC1B,CAAC;iBAAM,IAAI,QAAQ,EAAE,CAAC;gBACpB,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACzB,MAAM,EAAE,cAAc,EAAE,CAAC;gBACzB,6EAA6E;gBAC7E,kDAAkD;gBAClD,IAAI,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS,EAAE,KAAK,MAAM;oBAAE,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,EAAE,cAAc,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,CAAC,MAAM,GAAG;aACzB,IAAI,EAAE;aACN,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAA2C,CAAC;QACxG,MAAM,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,SAAc,CAAC;IAC9C,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;AACjC,CAAC;AAED;;iEAEiE;AACjE,MAAM,CAAC,KAAK,UAAU,UAAU,CAAI,IAAY,EAAE,UAA0B,EAAE;IAC5E,MAAM,EAAE,MAAM,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAExG,MAAM,OAAO,GAAG,KAAK,EAAE,MAAoB,EAAqB,EAAE,CAChE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE;QAC3B,MAAM;QACN,WAAW,EAAE,SAAS;QACtB,OAAO,EAAE;YACP,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE;QACD,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;QACrD,MAAM;QACN,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEL,OAAO,aAAa,CAAI,GAAG,MAAM,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC,CAAC;AACzG,CAAC;AAED;;;;0CAI0C;AAC1C,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAY,EACZ,QAAkB,EAClB,UAAuC,EAAE;IAEzC,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IAElC,MAAM,OAAO,GAAG,KAAK,IAAuB,EAAE,CAC5C,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACpB,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,SAAS;QACtB,OAAO,EAAE;YACP,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE;QACD,IAAI,EAAE,QAAQ;KACf,CAAC,CAAC;IAEL,OAAO,aAAa,CAAI,QAAQ,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;AACtE,CAAC"}
+{"version":3,"file":"httpClient.js","sourceRoot":"","sources":["../../../src/auth/client/httpClient.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,sBAAsB,EACtB,aAAa,GAGd,MAAM,oBAAoB,CAAC;AAkB5B;;;8EAG8E;AAC9E,MAAM,CAAC,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AAEpE,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,IAAI,CAAS;IACb,KAAK,CAAU;IACf,MAAM,CAAS;IACf;;qDAEiD;IACjD,IAAI,CAAyC;IAC7C,YAAY,MAAc,EAAE,IAA4C;QACtE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AAMxD;;;;;;;;;GASG;AACH,MAAM,OAAO,oBAAqB,SAAQ,eAAe;IAEvD,YAAY,MAAc,EAAE,IAAiF;QAC3G,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,SAAS,qBAAqB,CAAC,IAAa;IAC1C,OAAQ,sBAA6C,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACvE,CAAC;AAGD,MAAM,wBAAwB,GAAG,IAAI,GAAG,EAA2B,CAAC;AAEpE;;oFAEoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,QAAiC;IACjE,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,OAAO,GAAG,EAAE;QACV,wBAAwB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,KAA2B;IACvD,KAAK,MAAM,QAAQ,IAAI,wBAAwB;QAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;IACjE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;+BAE+B;AAC/B,KAAK,UAAU,iBAAiB,CAAC,GAAa;IAC5C,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG;SACpB,IAAI,EAAE;SACN,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAA2C,CAAC;IACxG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,OAAO,oBAAoB,CAAC,IAAI,oBAAoB,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,6DAA6D;AAC7D,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,IAAY,EAAE,EAAU;QAClC,KAAK,CAAC,GAAG,IAAI,4BAA4B,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,IAAI,WAAW,GAAkB,IAAI,CAAC;AACtC,IAAI,cAAc,GAAkC,IAAI,CAAC;AACzD,IAAI,OAAO,GAAG,SAAS,CAAC;AAExB,MAAM,UAAU,kBAAkB,CAAC,IAAyB;IAC1D,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAoB;IACjD,WAAW,GAAG,KAAK,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;sBACsB;AACtB,MAAM,UAAU,UAAU;IACxB,OAAO,OAAO,CAAC;AACjB,CAAC;AAQD,IAAI,YAAY,GAAwB,IAAI,CAAC;AAE7C;;;;;;+EAM+E;AAC/E,MAAM,UAAU,eAAe,CAAC,QAAsB;IACpD,YAAY,GAAG,QAAQ,CAAC;IACxB,OAAO,GAAG,EAAE;QACV,IAAI,YAAY,KAAK,QAAQ;YAAE,YAAY,GAAG,IAAI,CAAC;IACrD,CAAC,CAAC;AACJ,CAAC;AAED;;;4DAG4D;AAC5D,KAAK,UAAU,YAAY,CACzB,IAAY,EACZ,EAAU,EACV,GAAwC,EACxC,cAA4B;IAE5B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,cAAc,CAAC,OAAO;YAAE,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;;YAC/D,cAAc,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI,KAAgD,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QAChD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,MAAM,MAAM,GAAG,IAAI,oBAAoB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAClD,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACzB,MAAM,CAAC,MAAM,CAAC,CAAC;QACjB,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAChE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;4DAC4D;AAC5D,SAAS,kBAAkB,CAAC,MAAc,EAAE,KAAa;IACvD,OAAO,oBAAoB,CACzB,IAAI,oBAAoB,CAAC,MAAM,EAAE;QAC/B,KAAK,EAAE,6CAA6C,KAAK,EAAE;QAC3D,IAAI,EAAE,qBAAqB;KAC5B,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,WAAW,GAAG,aAAa,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;QAChE,cAAc,GAAG,YAAY,CAC3B,QAAQ,WAAW,EAAE,EACrB,2BAA2B,EAC3B,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,GAAG,WAAW,EAAE,EAAE;gBAClD,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,SAAS;gBACtB,MAAM;aACP,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YACpC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;gBAC3C,IAAI,KAAK,YAAY,oBAAoB;oBAAE,MAAM,KAAK,CAAC;gBACvD,MAAM,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,uBAAuB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC3D,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACjC,OAAO,IAAI,CAAC,WAAW,CAAC;QAC1B,CAAC,CACF;aACE,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtB,IAAI,GAAG,YAAY,oBAAoB;gBAAE,MAAM,GAAG,CAAC;YACnD,MAAM,kBAAkB,CACtB,CAAC,EACD,GAAG,YAAY,oBAAoB,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,iCAAiC,CAC9F,CAAC;QACJ,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,cAAc,GAAG,IAAI,CAAC;QACxB,CAAC,CAAC,CAAC;IACP,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AA0BD;gFACgF;AAChF,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,KAA+B;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,OAAO,GAAG,IAAI,EACd,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAC5E,CAAC;IACF,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE;gBAAE,SAAS;YAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;;gBACnF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,oFAAoF;IACpF,oFAAoF;IACpF,4CAA4C;IAC5C,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC;AAC7E,CAAC;AAID;;;;;kFAKkF;AAClF,KAAK,UAAU,aAAa,CAAI,KAAa,EAAE,OAAgB,EAAE,OAAoB;IACnF,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAC/B,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,mBAAmB,CAAI,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9E,OAAO,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAI,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AACvG,CAAC;AAED;;;;;4EAK4E;AAC5E,KAAK,UAAU,iBAAiB,CAC9B,OAAgB,EAChB,EAAE,aAAa,EAAE,gBAAgB,EAAe,EAChD,MAAoB;IAEpB,sFAAsF;IACtF,MAAM,QAAQ,GAAG,YAAY,CAAC;IAC9B,MAAM,MAAM,GAAG,QAAQ,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC;IAC7C,IAAI,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAEhC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACzC,gFAAgF;QAChF,8DAA8D;QAC9D,MAAM,SAAS,GAAG,MAAM,kBAAkB,EAAE,CAAC;QAC7C,iFAAiF;QACjF,mFAAmF;QACnF,8EAA8E;QAC9E,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,IAAI,SAAS;YAAE,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,4EAA4E;YAC5E,6EAA6E;YAC7E,6DAA6D;YAC7D,IAAI,QAAQ,IAAI,gBAAgB,EAAE,CAAC;gBACjC,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC1B,CAAC;iBAAM,IAAI,QAAQ,EAAE,CAAC;gBACpB,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACzB,MAAM,EAAE,cAAc,EAAE,CAAC;gBACzB,6EAA6E;gBAC7E,kDAAkD;gBAClD,IAAI,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC,SAAS,EAAE,KAAK,MAAM;oBAAE,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,EAAE,cAAc,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,OAAgB,EAChB,OAAoB,EACpB,MAAoB;IAEpB,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,SAAc,CAAC;IAC9C,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;AACjC,CAAC;AAED;;iEAEiE;AACjE,MAAM,CAAC,KAAK,UAAU,UAAU,CAAI,IAAY,EAAE,UAA0B,EAAE;IAC5E,MAAM,EAAE,MAAM,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAExG,MAAM,OAAO,GAAG,KAAK,EAAE,MAAoB,EAAqB,EAAE,CAChE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE;QAC3B,MAAM;QACN,WAAW,EAAE,SAAS;QACtB,OAAO,EAAE;YACP,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE;QACD,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;QACrD,MAAM;QACN,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEL,OAAO,aAAa,CAAI,GAAG,MAAM,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC,CAAC;AACzG,CAAC;AAED;;;;0CAI0C;AAC1C,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAY,EACZ,QAAkB,EAClB,UAAuC,EAAE;IAEzC,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IAElC,MAAM,OAAO,GAAG,KAAK,IAAuB,EAAE,CAC5C,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACpB,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,SAAS;QACtB,OAAO,EAAE;YACP,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE;QACD,IAAI,EAAE,QAAQ;KACf,CAAC,CAAC;IAEL,OAAO,aAAa,CAAI,QAAQ,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC;AACtE,CAAC;AAED;;;;oBAIoB;AACpB,SAAS,+BAA+B,CAAC,MAAqB;IAC5D,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,QAAQ,GAAG,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1D,IAAI,QAAQ,EAAE,CAAC;QACb,+EAA+E;QAC/E,sDAAsD;QACtD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACtC,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;YACvE,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1D,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtC,CAAC;AAqBD;;;0EAG0E;AAC1E,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,UAA8B,EAAE;IAC9E,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC;IAE7D,MAAM,OAAO,GAAG,KAAK,EAAE,WAAyB,EAAqB,EAAE,CACrE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE;QAC3B,MAAM,EAAE,KAAK;QACb,WAAW,EAAE,SAAS;QACtB,OAAO,EAAE;YACP,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE;QACD,MAAM,EAAE,WAAW;KACpB,CAAC,CAAC;IAEL,MAAM,MAAM,GAAG,KAAK,EAAE,GAAa,EAA8B,EAAE;QACjE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,0BAA0B,CAAC;QACzG,MAAM,QAAQ,GAAG,+BAA+B,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC;QACzF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;IACzC,CAAC,CAAC;IAEF,MAAM,GAAG,GAAG,KAAK,EAAE,WAAyB,EAA8B,EAAE,CAC1E,MAAM,CAAC,MAAM,iBAAiB,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;IAE3E,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC;IACjD,OAAO,YAAY,CAAC,OAAO,IAAI,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED;;+CAE+C;AAC/C,MAAM,UAAU,QAAQ,CAAC,IAAU,EAAE,QAAgB;IACnD,IAAI,OAAO,QAAQ,KAAK,WAAW;QAAE,OAAO;IAC5C,MAAM,UAAU,GAAG,GAAkC,CAAC;IACtD,MAAM,GAAG,GAAG,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC;QAClB,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC3B,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC;YAAS,CAAC;QACT,UAAU,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;AACH,CAAC"}

package/dist/auth/client/index.d.ts

@@ -4,9 +4,9 @@
  * browser bundle. See httpClient.ts and useAuthSession.ts's own doc comments for what
  * was extracted from where and why (AK-16).
  */
-export { ApiRequestError, RequestDeadlineError, DEFAULT_REQUEST_DEADLINE_MS, configureApiClient, setAccessToken, getAccessToken, getBaseUrl, setAuthRecovery, apiRequest, apiUpload, type AuthRecovery, type RequestOptions, } from "./httpClient.js";
-export { useAuthSession, type AuthStatus, type AuthSessionState, type LoadingSessionState, type AuthenticatedSessionState, type UnauthenticatedSessionState, type ErrorSessionState, } from "./useAuthSession.js";
+export { ApiRequestError, AuthUnavailableError, AUTH_UNREACHABLE_CODE, type AuthUnavailableErrorCode, RequestDeadlineError, onAuthUnavailable, DEFAULT_REQUEST_DEADLINE_MS, configureApiClient, setAccessToken, getAccessToken, getBaseUrl, setAuthRecovery, apiRequest, apiUpload, apiDownload, saveBlob, type AuthRecovery, type RequestOptions, type ApiDownloadOptions, type ApiDownloadResult, } from "./httpClient.js";
+export { useAuthSession, unavailableRetryDelayMs, UNAVAILABLE_RETRY_BASE_MS, UNAVAILABLE_RETRY_MAX_MS, type AuthStatus, type AuthSessionState, type LoadingSessionState, type AuthenticatedSessionState, type UnauthenticatedSessionState, type UnavailableSessionState, type ErrorSessionState, } from "./useAuthSession.js";
 export { attemptSilentResume, type SilentResumeResult, type AttemptSilentResumeOptions, } from "./silentAuth.js";
 export { consumeSignInError } from "./signInError.js";
-export type { AppSwitcherEntry, AuthedUserDto, IdpRole, ApiErrorBody, SilentAuthMessage } from "../shared-types.js";
-export { AUTH_ROUTE_PREFIX, AUTH_ROUTE_SEGMENTS, authRoutePath, SIGNIN_ERROR_QUERY_PARAM, SIGNIN_ERROR_CODES, type AuthRouteSegment, type SignInErrorCode, } from "../shared-types.js";
+export type { AppSwitcherEntry, AuthedUserDto, IdpRole, ApiErrorBody, AuthUnavailableCode, SilentAuthDetailCode, SilentAuthMessage, } from "../shared-types.js";
+export { AUTH_ROUTE_PREFIX, AUTH_ROUTE_SEGMENTS, AUTH_UNAVAILABLE_CODES, authRoutePath, SILENT_AUTH_DETAIL_CODES, SIGNIN_ERROR_QUERY_PARAM, SIGNIN_ERROR_CODES, type AuthRouteSegment, type SignInErrorCode, } from "../shared-types.js";

package/dist/auth/client/index.js

@@ -4,9 +4,9 @@
  * browser bundle. See httpClient.ts and useAuthSession.ts's own doc comments for what
  * was extracted from where and why (AK-16).
  */
-export { ApiRequestError, RequestDeadlineError, DEFAULT_REQUEST_DEADLINE_MS, configureApiClient, setAccessToken, getAccessToken, getBaseUrl, setAuthRecovery, apiRequest, apiUpload, } from "./httpClient.js";
-export { useAuthSession, } from "./useAuthSession.js";
+export { ApiRequestError, AuthUnavailableError, AUTH_UNREACHABLE_CODE, RequestDeadlineError, onAuthUnavailable, DEFAULT_REQUEST_DEADLINE_MS, configureApiClient, setAccessToken, getAccessToken, getBaseUrl, setAuthRecovery, apiRequest, apiUpload, apiDownload, saveBlob, } from "./httpClient.js";
+export { useAuthSession, unavailableRetryDelayMs, UNAVAILABLE_RETRY_BASE_MS, UNAVAILABLE_RETRY_MAX_MS, } from "./useAuthSession.js";
 export { attemptSilentResume, } from "./silentAuth.js";
 export { consumeSignInError } from "./signInError.js";
-export { AUTH_ROUTE_PREFIX, AUTH_ROUTE_SEGMENTS, authRoutePath, SIGNIN_ERROR_QUERY_PARAM, SIGNIN_ERROR_CODES, } from "../shared-types.js";
+export { AUTH_ROUTE_PREFIX, AUTH_ROUTE_SEGMENTS, AUTH_UNAVAILABLE_CODES, authRoutePath, SILENT_AUTH_DETAIL_CODES, SIGNIN_ERROR_QUERY_PARAM, SIGNIN_ERROR_CODES, } from "../shared-types.js";
 //# sourceMappingURL=index.js.map

package/dist/auth/client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/client/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,UAAU,EACV,eAAe,EACf,UAAU,EACV,SAAS,GAGV,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,cAAc,GAOf,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,mBAAmB,GAGpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAGtD,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,wBAAwB,EACxB,kBAAkB,GAGnB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/client/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,qBAAqB,EAErB,oBAAoB,EACpB,iBAAiB,EACjB,2BAA2B,EAC3B,kBAAkB,EAClB,cAAc,EACd,cAAc,EACd,UAAU,EACV,eAAe,EACf,UAAU,EACV,SAAS,EACT,WAAW,EACX,QAAQ,GAKT,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EACL,cAAc,EACd,uBAAuB,EACvB,yBAAyB,EACzB,wBAAwB,GAQzB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,mBAAmB,GAGpB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAWtD,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,aAAa,EACb,wBAAwB,EACxB,wBAAwB,EACxB,kBAAkB,GAGnB,MAAM,oBAAoB,CAAC"}