@owlmeans/api 0.1.18-rc.4 → 0.1.18-rc.40

package/README.md

@@ -1,6 +1,6 @@
 # @owlmeans/api
 
-HTTP API client service for OwlMeans client contexts — handles module-based requests with auth token injection.
+HTTP API client service for OwlMeans client contexts — carries entrypoint calls with auth token injection.
 
 ## Overview
 
@@ -12,7 +12,7 @@ HTTP API client service for OwlMeans client contexts — handles module-based re
 ## Installation
 
 ```bash
-bun add @owlmeans/api
+bun add @owlmeans/api@^0.1.18-rc.40
 ```
 
 ## Usage
@@ -54,7 +54,7 @@ Registers the API client in the context.
 
 ## Related Packages
 
-- [`@owlmeans/client-module`](../client-module) — `ClientModule<T>` uses this service to make requests
+- [`@owlmeans/client-entrypoint`](../client-entrypoint) — bound protocols use this service to make requests
 - [`@owlmeans/web-client`](../web-client) — registers this service via `makeContext`
 
 <!-- owlmeans:agent-guidance:start -->
@@ -65,7 +65,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills
+npx @owlmeans/agent-skills@^0.1.18-rc.41
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/api",
-  "version": "0.1.18-rc.0",
-  "generatedAt": "2026-08-16T22:20:50.518Z",
+  "version": "0.1.18-rc.40",
+  "generatedAt": "2026-09-28T02:06:37.895Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/api/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: api
-description: How to use @owlmeans/api — HTTP client service (axios-based) used to call entrypoints across services. Auto-invoked when importing the API service or when ctx.entrypoint(...).call() under the hood is involved.
+description: How to use @owlmeans/api — the axios-based HTTP client service that carries entrypoint calls between services, its status-to-outcome mapping, typed transport errors that keep the HTTP status and incident id (the ./status subpath), and per-request timeout/abort. Auto-invoked when importing the API client, reading a failed call's status, or when ctx.entrypoint(...).call() under the hood is involved.
 user-invocable: false
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
@@ -8,28 +8,113 @@ user-invocable: false
 # @owlmeans/api
 
 **Layer:** Core
-**Install:** `"@owlmeans/api": "^0.1.18-rc.0"` in `dependencies`
+**Install:** `"@owlmeans/api": "^0.1.18-rc.40"` in `dependencies`
 
 ## Key Exports
 
 | Export | Description |
 |--------|-------------|
-| `makeApiService()` | Factory for the HTTP client service (axios) |
-| `Api` types | Service interface |
-| Errors | Typed transport errors (Network, Timeout, HttpStatus) |
-| Constants | Default timeout, retry counts |
+| `createApiService(alias?)` | Factory for the HTTP client service (axios) |
+| `appendApiClient(ctx, alias?)` | Register it and make it the context's default `webService` when none is set |
+| `ApiClient` | Service interface — a single `handler(req, reply)` |
+| `ApiError`, `ApiClientError`, `ServerCrashedError`, `ServerAuthError`, `ApiStatusError` | Typed transport errors; an `ApiClientError` carries the answered `status` and the server's `incidentId` |
+| `httpStatusOf`, `incidentIdOf`, `isAccessDenied`, `isIncidentBody`, `parseClientMarker`, `API_CLIENT_MARKER`, `API_STATUS_MARKER` | Read a failure's HTTP status, incident id and IAM denial marker (also the `./status` subpath) |
+| Constants | Status codes (`OK`, `CREATED`, `ACCEPTED`, `FINISHED`, `UNAUTHORIZED_ERROR`, `FORBIDDEN_ERROR`, `SERVER_ERROR`), `INCIDENT_ID_HEADER` (`X-Incident-ID`), `DEFAULT_ALIAS` (`web-client`) |
+
+Subpath `./status` — `httpStatusOf`, `incidentIdOf`, `isIncidentBody`, `parseClientMarker`, the
+markers and `INCIDENT_ID_HEADER`, importing only `@owlmeans/error`: a browser package reads a
+status without pulling axios in.
+
+`isAccessDenied(error)` requires the server's `X-OwlMeans-Denial: access-denied` marker and a 403.
+Do not classify all 403 responses as IAM denials: entitlement and other refusals use that status
+too. The API client stamps the marker on its rejection even under production error exposure.
+
+## How a call is carried
+
+`ep.call(...)` / `ep.invoke(...)` hand the request to whatever is bound to the route's protocol. When
+a transport service is registered under `transportAlias(protocol)` it takes the call; otherwise this
+package's client does, over HTTP. Either way the consumer writes the same line and never learns which
+one ran.
+
+When it is this client, the entrypoint answers where it lives — `path()` for the path, `address()` for
+host, port, base, protocol and whether the hop is TLS — and `makeSecurityHelper` assembles the URL from
+that. A per-request `host`, `base` or `unsecure` still overrides it. `:params` come from
+`request.params` and a missing one is a `SyntaxError`, not a literal `:id` in the URL.
+
+A request whose `canceled` flag is already set is dropped without a round trip.
+
+## Per-request controls
+
+These live on the request the caller passes and are forwarded to the transport:
+
+- `timeout` — milliseconds for the single round trip; omitted or `0` means no timeout, so a stuck
+  peer hangs forever unless a caller bounds it.
+- `signal` — an `AbortSignal`, which aborts the request in flight.
+- `headers` — a `content-type` of `application/x-www-form-urlencoded` makes the body serialize
+  through `qs` instead of JSON. A string body on a `POST` with no `content-type` gets
+  `application/json` and is sent verbatim rather than re-quoted.
+
+## Reading the answer
+
+`validateStatus` is `() => true`, so **no status throws**: every answer the peer sends, 4xx and 5xx
+included, comes back and is mapped here.
+
+| Status | Result |
+|--------|--------|
+| 200 / 202 | Resolves with the body and an `Ok` / `Accepted` outcome |
+| 201 / 204 | Resolves with the body, or with the response headers when the body is empty |
+| any other | Rejects |
+
+Every rejection keeps the HTTP status and, when the server sent one, its incident id (the
+`X-Incident-ID` header, read from `AxiosHeaders` or a plain object, else a bare UUID body — a
+browser reads that header cross-origin only when the server exposes it, the body covers the rest):
+
+| Body | Rejects with |
+|---|---|
+| Development — the marshaled `ResilientError` (carries the separator) | The original class, rebuilt through the registry, stamped `responseStatus` and `incidentId` |
+| Production — a bare incident UUID; also proxy HTML, framework JSON, anything else | `ServerCrashedError` `api:client:crashed:<id>` (500) · `ServerAuthError` `api:client:auth:<id>` (401) · `ApiClientError` `api:client:forbidden[:<id>]` (403) · `ApiStatusError` `api:client:status:<n>[:<id>]` (every other status) |
+
+An `@owlmeans/server-api` boundary in production exposure sends ONLY the incident id, so a typed
+refusal's class never reaches the browser — its status does. Read it with `httpStatusOf(e)`: the
+stamped `responseStatus`, else an `ApiClientError`'s parsed `status`, else a class's declared
+`httpStatus` (a 4xx; a 5xx only with `allowServerErrorStatus`, exactly what the server answers),
+else an `api:client:*` marker in the message or type; `null` when nothing states one. A consumer
+that acts on a refusal checks the class/marker AND the status (`consentRefusalOf(e) ||
+httpStatusOf(e) === 428`). Markers without an id stay as they were (`api:client:crashed:error`,
+`api:client:forbidden`). The status and id are rebuilt from the marker in `finalizeUnmarshal()`,
+so they survive a marshal. No class of this family declares a static `httpStatus`: a server that
+rethrows one still answers 500.
+
+**A failure with no answer at all is a different family.** Suppressing status errors does not wrap
+the call: an expired `timeout` (`ECONNABORTED`), an aborted `signal` (`CanceledError` /
+`ERR_CANCELED`), a refused connection or a DNS failure rejects with the raw axios error, which is
+none of the typed errors above. A caller that bounds a call has to catch that too — testing for
+`ApiClientError` alone lets a timeout through as an unhandled rejection.
+
+An `auth-token-refresh` response header is consumed here: when the context has an auth service, the
+rotated token is handed to it, which is what keeps a long session alive without the caller doing
+anything.
+
+Building a URL without making the call is a different question — that is `entrypointUrl` from
+`@owlmeans/client-entrypoint/utils`, or `ep.url(req, { absolute })`.
 
 ## Usage
 
-The api service backs `ctx.entrypoint<ClientEntrypoint<T>>(alias).call(...)` cross-service calls. Most apps don't import it directly — they register it once in their context factory:
+Most apps don't import this directly — they register it once in their context factory:
 
 ```typescript
-import { makeApiService } from '@owlmeans/api'
-context.registerService(makeApiService())
+import { appendApiClient } from '@owlmeans/api'
+appendApiClient(context)
 ```
 
+`appendApiClient` only claims `cfg.webService` when it is unset, so an app that has already named a
+transport keeps it.
+
 ## Depends On
 
 - `@owlmeans/context` — service registration
-- `@owlmeans/error`, `@owlmeans/i18n`
-- `axios` (runtime)
+- `@owlmeans/entrypoint` — the entrypoint being addressed, `@owlmeans/client-route` — `extractParams`
+- `@owlmeans/config` — `makeSecurityHelper`, `@owlmeans/client-config` — the config shape
+- `@owlmeans/auth-common` — the token-refresh header and the auth service it updates
+- `@owlmeans/error`, `@owlmeans/route`
+- `axios`, `qs` (runtime)

package/build/consts.d.ts

@@ -5,6 +5,13 @@ export declare const OK = 200;
 export declare const CREATED = 201;
 export declare const ACCEPTED = 202;
 export declare const FINISHED = 204;
+/**
+ * The response header an `@owlmeans/server-api` boundary puts its incident id in — the key to the
+ * server log entry that owns a failure's full detail.
+ */
+export declare const INCIDENT_ID_HEADER = "X-Incident-ID";
+export declare const DENIAL_KIND_HEADER = "X-OwlMeans-Denial";
+export declare const ACCESS_DENIED_KIND = "access-denied";
 export declare const DEFAULT_ALIAS = "web-client";
 export declare const protocols: string[];
 //# sourceMappingURL=consts.d.ts.map

package/build/consts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,YAAY,MAAM,CAAA;AAE/B,eAAO,MAAM,kBAAkB,MAAM,CAAA;AAErC,eAAO,MAAM,eAAe,MAAM,CAAA;AAElC,eAAO,MAAM,EAAE,MAAM,CAAA;AAErB,eAAO,MAAM,OAAO,MAAM,CAAA;AAE1B,eAAO,MAAM,QAAQ,MAAM,CAAA;AAE3B,eAAO,MAAM,QAAQ,MAAM,CAAA;AAE3B,eAAO,MAAM,aAAa,eAAe,CAAA;AAEzC,eAAO,MAAM,SAAS,UAAiC,CAAA"}
+{"version":3,"file":"consts.d.ts","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,YAAY,MAAM,CAAA;AAE/B,eAAO,MAAM,kBAAkB,MAAM,CAAA;AAErC,eAAO,MAAM,eAAe,MAAM,CAAA;AAElC,eAAO,MAAM,EAAE,MAAM,CAAA;AAErB,eAAO,MAAM,OAAO,MAAM,CAAA;AAE1B,eAAO,MAAM,QAAQ,MAAM,CAAA;AAE3B,eAAO,MAAM,QAAQ,MAAM,CAAA;AAE3B;;;GAGG;AACH,eAAO,MAAM,kBAAkB,kBAAkB,CAAA;AACjD,eAAO,MAAM,kBAAkB,sBAAsB,CAAA;AACrD,eAAO,MAAM,kBAAkB,kBAAkB,CAAA;AAEjD,eAAO,MAAM,aAAa,eAAe,CAAA;AAEzC,eAAO,MAAM,SAAS,UAAiC,CAAA"}

package/build/consts.js

@@ -5,6 +5,13 @@ export const OK = 200;
 export const CREATED = 201;
 export const ACCEPTED = 202;
 export const FINISHED = 204;
+/**
+ * The response header an `@owlmeans/server-api` boundary puts its incident id in — the key to the
+ * server log entry that owns a failure's full detail.
+ */
+export const INCIDENT_ID_HEADER = 'X-Incident-ID';
+export const DENIAL_KIND_HEADER = 'X-OwlMeans-Denial';
+export const ACCESS_DENIED_KIND = 'access-denied';
 export const DEFAULT_ALIAS = 'web-client';
 export const protocols = ['http', 'https', 'wss', 'ws'];
 //# sourceMappingURL=consts.js.map

package/build/consts.js.map

@@ -1 +1 @@
-{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AACA,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,CAAA;AAE/B,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAA;AAErC,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAA;AAElC,MAAM,CAAC,MAAM,EAAE,GAAG,GAAG,CAAA;AAErB,MAAM,CAAC,MAAM,OAAO,GAAG,GAAG,CAAA;AAE1B,MAAM,CAAC,MAAM,QAAQ,GAAG,GAAG,CAAA;AAE3B,MAAM,CAAC,MAAM,QAAQ,GAAG,GAAG,CAAA;AAE3B,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAA;AAEzC,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA"}
+{"version":3,"file":"consts.js","sourceRoot":"","sources":["../src/consts.ts"],"names":[],"mappings":"AACA,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,CAAA;AAE/B,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAA;AAErC,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAA;AAElC,MAAM,CAAC,MAAM,EAAE,GAAG,GAAG,CAAA;AAErB,MAAM,CAAC,MAAM,OAAO,GAAG,GAAG,CAAA;AAE1B,MAAM,CAAC,MAAM,QAAQ,GAAG,GAAG,CAAA;AAE3B,MAAM,CAAC,MAAM,QAAQ,GAAG,GAAG,CAAA;AAE3B;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAe,CAAA;AACjD,MAAM,CAAC,MAAM,kBAAkB,GAAG,mBAAmB,CAAA;AACrD,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAe,CAAA;AAEjD,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAA;AAEzC,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA"}

package/build/errors.d.ts

@@ -3,16 +3,44 @@ export declare class ApiError extends ResilientError {
     static typeName: string;
     constructor(message?: string);
 }
+/**
+ * A request the peer answered with a failure.
+ *
+ * `status` is the HTTP status the marker in the message states (`api:client:crashed:<id>` is 500,
+ * `api:client:auth:<id>` 401, `api:client:forbidden[:<id>]` 403, `api:client:status:<n>[:<id>]`
+ * any other); `incidentId` is the server's correlation id when the marker carries one. Only
+ * `type` and `message` survive a marshal, so both are rebuilt from the message in
+ * `finalizeUnmarshal()`. No class of this family declares a static `httpStatus`: a server that
+ * rethrows one answers 500, as before.
+ */
 export declare class ApiClientError extends ApiError {
     static typeName: string;
+    /** The HTTP status the peer answered with, when the message states one. */
+    status?: number;
     constructor(message?: string);
+    protected applyStatus(): void;
+    finalizeUnmarshal(): void;
 }
+/** The peer answered 500. Marker `api:client:crashed:<incident id | error>`. */
 export declare class ServerCrashedError extends ApiClientError {
     static typeName: string;
-    constructor(message?: string);
+    constructor(incidentId?: string);
 }
+/** The peer answered 401. Marker `api:client:auth:<incident id | error>`. */
 export declare class ServerAuthError extends ApiClientError {
     static typeName: string;
-    constructor(message?: string);
+    constructor(incidentId?: string);
+}
+/**
+ * The peer answered any other non-2xx status with no typed error in the body — a production
+ * incident id, a proxy's HTML page, a framework's JSON. Marker `api:client:status:<n>[:<id>]`.
+ */
+export declare class ApiStatusError extends ApiClientError {
+    static typeName: string;
+    /** The marker body: `<status>[:<incident id>]`. */
+    static encode(status: number, incidentId?: string): string;
+    constructor(status: number, incidentId?: string);
+    /** A marker body (`ApiStatusError.encode`) or a marshaled message — the error registry's path. */
+    constructor(message: string);
 }
 //# sourceMappingURL=errors.d.ts.map

package/build/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD,qBAAa,QAAS,SAAQ,cAAc;IAC1C,OAAuB,QAAQ,SAAa;IAE5C,YAAY,OAAO,GAAE,MAAgB,EAEpC;CACF;AAED,qBAAa,cAAe,SAAQ,QAAQ;IAC1C,OAAuB,QAAQ,SAAmB;IAElD,YAAY,OAAO,GAAE,MAAgB,EAGpC;CACF;AAED,qBAAa,kBAAmB,SAAQ,cAAc;IACpD,OAAuB,QAAQ,SAA4C;IAE3E,YAAY,OAAO,GAAE,MAAgB,EAGpC;CACF;AAED,qBAAa,eAAgB,SAAQ,cAAc;IACjD,OAAuB,QAAQ,SAAyC;IAExE,YAAY,OAAO,GAAE,MAAgB,EAGpC;CACF"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAGhD,qBAAa,QAAS,SAAQ,cAAc;IAC1C,OAAuB,QAAQ,SAAa;IAE5C,YAAY,OAAO,GAAE,MAAgB,EAEpC;CACF;AAED;;;;;;;;;GASG;AACH,qBAAa,cAAe,SAAQ,QAAQ;IAC1C,OAAuB,QAAQ,SAAmB;IAElD,2EAA2E;IACpE,MAAM,CAAC,EAAE,MAAM,CAAA;IAEtB,YAAY,OAAO,GAAE,MAAgB,EAIpC;IAED,SAAS,CAAC,WAAW,IAAI,IAAI,CAM5B;IAEQ,iBAAiB,IAAI,IAAI,CAEjC;CACF;AAED,gFAAgF;AAChF,qBAAa,kBAAmB,SAAQ,cAAc;IACpD,OAAuB,QAAQ,SAA4C;IAE3E,YAAY,UAAU,CAAC,EAAE,MAAM,EAG9B;CACF;AAED,6EAA6E;AAC7E,qBAAa,eAAgB,SAAQ,cAAc;IACjD,OAAuB,QAAQ,SAAyC;IAExE,YAAY,UAAU,CAAC,EAAE,MAAM,EAG9B;CACF;AAED;;;GAGG;AACH,qBAAa,cAAe,SAAQ,cAAc;IAChD,OAAuB,QAAQ,SAAqC;IAEpE,mDAAmD;IACnD,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAEzD;IAED,YAAY,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAC;IAChD,kGAAkG;IAClG,YAAY,OAAO,EAAE,MAAM,EAAC;CAK7B"}

package/build/errors.js

@@ -1,33 +1,75 @@
 import { ResilientError } from '@owlmeans/error';
+import { parseClientMarker } from './status/marker.js';
 export class ApiError extends ResilientError {
     static typeName = 'ApiError';
     constructor(message = 'error') {
         super(ApiError.typeName, `api:${message}`);
     }
 }
+/**
+ * A request the peer answered with a failure.
+ *
+ * `status` is the HTTP status the marker in the message states (`api:client:crashed:<id>` is 500,
+ * `api:client:auth:<id>` 401, `api:client:forbidden[:<id>]` 403, `api:client:status:<n>[:<id>]`
+ * any other); `incidentId` is the server's correlation id when the marker carries one. Only
+ * `type` and `message` survive a marshal, so both are rebuilt from the message in
+ * `finalizeUnmarshal()`. No class of this family declares a static `httpStatus`: a server that
+ * rethrows one answers 500, as before.
+ */
 export class ApiClientError extends ApiError {
     static typeName = 'ApiClientError';
+    /** The HTTP status the peer answered with, when the message states one. */
+    status;
     constructor(message = 'error') {
         super(`client:${message}`);
         this.type = ApiClientError.typeName;
+        this.applyStatus();
+    }
+    applyStatus() {
+        const marker = parseClientMarker(this.message);
+        this.status = marker?.status;
+        if (marker?.incidentId != null) {
+            this.incidentId ??= marker.incidentId;
+        }
+    }
+    finalizeUnmarshal() {
+        this.applyStatus();
     }
 }
+/** The peer answered 500. Marker `api:client:crashed:<incident id | error>`. */
 export class ServerCrashedError extends ApiClientError {
     static typeName = `${ApiClientError.typeName}ServerCrashed`;
-    constructor(message = 'error') {
-        super(`crashed:${message}`);
+    constructor(incidentId) {
+        super(`crashed:${incidentId ?? 'error'}`);
         this.type = ServerCrashedError.typeName;
     }
 }
+/** The peer answered 401. Marker `api:client:auth:<incident id | error>`. */
 export class ServerAuthError extends ApiClientError {
     static typeName = `${ApiClientError.typeName}ServerAuth`;
-    constructor(message = 'error') {
-        super(`auth:${message}`);
+    constructor(incidentId) {
+        super(`auth:${incidentId ?? 'error'}`);
         this.type = ServerAuthError.typeName;
     }
 }
+/**
+ * The peer answered any other non-2xx status with no typed error in the body — a production
+ * incident id, a proxy's HTML page, a framework's JSON. Marker `api:client:status:<n>[:<id>]`.
+ */
+export class ApiStatusError extends ApiClientError {
+    static typeName = `${ApiClientError.typeName}Status`;
+    /** The marker body: `<status>[:<incident id>]`. */
+    static encode(status, incidentId) {
+        return incidentId != null && incidentId !== '' ? `${status}:${incidentId}` : `${status}`;
+    }
+    constructor(status = 'error', incidentId) {
+        super(`status:${typeof status === 'number' ? ApiStatusError.encode(status, incidentId) : status}`);
+        this.type = ApiStatusError.typeName;
+    }
+}
 ResilientError.registerErrorClass(ApiError);
 ResilientError.registerErrorClass(ApiClientError);
 ResilientError.registerErrorClass(ServerCrashedError);
 ResilientError.registerErrorClass(ServerAuthError);
+ResilientError.registerErrorClass(ApiStatusError);
 //# sourceMappingURL=errors.js.map

package/build/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD,MAAM,OAAO,QAAS,SAAQ,cAAc;IACnC,MAAM,CAAU,QAAQ,GAAG,UAAU,CAAA;IAE5C,YAAY,OAAO,GAAW,OAAO;QACnC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,OAAO,EAAE,CAAC,CAAA;IAC5C,CAAC;CACF;AAED,MAAM,OAAO,cAAe,SAAQ,QAAQ;IACnC,MAAM,CAAU,QAAQ,GAAG,gBAAgB,CAAA;IAElD,YAAY,OAAO,GAAW,OAAO;QACnC,KAAK,CAAC,UAAU,OAAO,EAAE,CAAC,CAAA;QAC1B,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAA;IACrC,CAAC;CACF;AAED,MAAM,OAAO,kBAAmB,SAAQ,cAAc;IAC7C,MAAM,CAAU,QAAQ,GAAG,GAAG,cAAc,CAAC,QAAQ,eAAe,CAAA;IAE3E,YAAY,OAAO,GAAW,OAAO;QACnC,KAAK,CAAC,WAAW,OAAO,EAAE,CAAC,CAAA;QAC3B,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,QAAQ,CAAA;IACzC,CAAC;CACF;AAED,MAAM,OAAO,eAAgB,SAAQ,cAAc;IAC1C,MAAM,CAAU,QAAQ,GAAG,GAAG,cAAc,CAAC,QAAQ,YAAY,CAAA;IAExE,YAAY,OAAO,GAAW,OAAO;QACnC,KAAK,CAAC,QAAQ,OAAO,EAAE,CAAC,CAAA;QACxB,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAA;IACtC,CAAC;CACF;AAED,cAAc,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAA;AAC3C,cAAc,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;AACjD,cAAc,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAA;AACrD,cAAc,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAA"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAEtD,MAAM,OAAO,QAAS,SAAQ,cAAc;IACnC,MAAM,CAAU,QAAQ,GAAG,UAAU,CAAA;IAE5C,YAAY,OAAO,GAAW,OAAO;QACnC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,OAAO,EAAE,CAAC,CAAA;IAC5C,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,cAAe,SAAQ,QAAQ;IACnC,MAAM,CAAU,QAAQ,GAAG,gBAAgB,CAAA;IAElD,2EAA2E;IACpE,MAAM,CAAS;IAEtB,YAAY,OAAO,GAAW,OAAO;QACnC,KAAK,CAAC,UAAU,OAAO,EAAE,CAAC,CAAA;QAC1B,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAA;QACnC,IAAI,CAAC,WAAW,EAAE,CAAA;IACpB,CAAC;IAES,WAAW;QACnB,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC9C,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,MAAM,CAAA;QAC5B,IAAI,MAAM,EAAE,UAAU,IAAI,IAAI,EAAE,CAAC;YAC/B,IAAI,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,CAAA;QACvC,CAAC;IACH,CAAC;IAEQ,iBAAiB;QACxB,IAAI,CAAC,WAAW,EAAE,CAAA;IACpB,CAAC;CACF;AAED,gFAAgF;AAChF,MAAM,OAAO,kBAAmB,SAAQ,cAAc;IAC7C,MAAM,CAAU,QAAQ,GAAG,GAAG,cAAc,CAAC,QAAQ,eAAe,CAAA;IAE3E,YAAY,UAAmB;QAC7B,KAAK,CAAC,WAAW,UAAU,IAAI,OAAO,EAAE,CAAC,CAAA;QACzC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,QAAQ,CAAA;IACzC,CAAC;CACF;AAED,6EAA6E;AAC7E,MAAM,OAAO,eAAgB,SAAQ,cAAc;IAC1C,MAAM,CAAU,QAAQ,GAAG,GAAG,cAAc,CAAC,QAAQ,YAAY,CAAA;IAExE,YAAY,UAAmB;QAC7B,KAAK,CAAC,QAAQ,UAAU,IAAI,OAAO,EAAE,CAAC,CAAA;QACtC,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAA;IACtC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,cAAe,SAAQ,cAAc;IACzC,MAAM,CAAU,QAAQ,GAAG,GAAG,cAAc,CAAC,QAAQ,QAAQ,CAAA;IAEpE,mDAAmD;IACnD,MAAM,CAAC,MAAM,CAAC,MAAc,EAAE,UAAmB;QAC/C,OAAO,UAAU,IAAI,IAAI,IAAI,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,CAAA;IAC1F,CAAC;IAKD,YAAY,MAAM,GAAoB,OAAO,EAAE,UAAmB;QAChE,KAAK,CAAC,UAAU,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;QAClG,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAA;IACrC,CAAC;CACF;AAED,cAAc,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAA;AAC3C,cAAc,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;AACjD,cAAc,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAA;AACrD,cAAc,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAA;AAClD,cAAc,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA"}

package/build/index.d.ts

@@ -2,4 +2,6 @@ export * from './errors.js';
 export * from './consts.js';
 export * from './service.js';
 export type * from './types.js';
+export { httpStatusOf, incidentIdOf, isIncidentBody, parseClientMarker, API_CLIENT_MARKER, API_STATUS_MARKER, } from './status/index.js';
+export type { ClientMarker, ResponseStatusCarrier } from './status/index.js';
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,mBAAmB,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,mBAAmB,YAAY,CAAA;AAC/B,OAAO,EACL,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,GACpG,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA"}

package/build/index.js

@@ -1,4 +1,5 @@
 export * from './errors.js';
 export * from './consts.js';
 export * from './service.js';
+export { httpStatusOf, incidentIdOf, isIncidentBody, parseClientMarker, API_CLIENT_MARKER, API_STATUS_MARKER, } from './status/index.js';
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAE5B,OAAO,EACL,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,GACpG,MAAM,mBAAmB,CAAA"}

package/build/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAErD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAM3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAO3D,KAAK,MAAM,GAAG,iBAAiB,CAAA;AAE/B,UAAU,OAAO,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,CAAE,SAAQ,YAAY,CAAC,CAAC,CAAC;CACnE;AAED,eAAO,MAAM,gBAAgB,WAAW,MAAM,KAAmB,SA4EhE,CAAA;AAED,eAAO,MAAM,eAAe,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,UAAS,MAAM,KAAmB,CAU/G,CAAA"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAErD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAM3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAa3D,KAAK,MAAM,GAAG,iBAAiB,CAAA;AAE/B,UAAU,OAAO,CAAC,CAAC,SAAS,MAAM,GAAG,MAAM,CAAE,SAAQ,YAAY,CAAC,CAAC,CAAC;CACnE;AAED,eAAO,MAAM,gBAAgB,WAAW,MAAM,KAAmB,SA+FhE,CAAA;AAED,eAAO,MAAM,eAAe,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,UAAS,MAAM,KAAmB,CAU/G,CAAA"}

package/build/service.js

@@ -1,12 +1,14 @@
 import { assertContext, createService } from '@owlmeans/context';
 import { extractParams } from '@owlmeans/client-route';
 import axios from 'axios';
-import { DEFAULT_ALIAS } from './consts.js';
+import { DEFAULT_ALIAS, UNAUTHORIZED_ERROR } from './consts.js';
 import { processResponse } from './utils/handler.js';
 import qs from 'qs';
 import { makeSecurityHelper } from '@owlmeans/config';
 import { RouteMethod } from '@owlmeans/route';
-import { DEF_AUTH_SRV, TOKEN_UPDATE } from '@owlmeans/auth-common';
+import { AUTH_HEADER, DEF_AUTH_SRV, TOKEN_UPDATE } from '@owlmeans/auth-common';
+/** Whether a request carried an authentication header of its own. */
+const presented = (headers) => headers != null && Object.entries(headers).some(([key, value]) => key.toLowerCase() === AUTH_HEADER && value != null && value !== '');
 export const createApiService = (alias = DEFAULT_ALIAS) => {
     const location = `api.service:${alias}`;
     const client = createService(alias, {
@@ -16,9 +18,8 @@ export const createApiService = (alias = DEFAULT_ALIAS) => {
             }
             const context = assertContext(client.ctx, location);
             const module = context.entrypoint(request.alias);
-            await module.resolve();
             const route = module.route.route;
-            let path = module.getPath();
+            let path = module.path();
             const params = extractParams(path);
             path = params.reduce((path, param) => {
                 if (request.params[param] == null) {
@@ -26,11 +27,10 @@ export const createApiService = (alias = DEFAULT_ALIAS) => {
                 }
                 return path.replace(`:${param}`, `${request.params[param]}`);
             }, path);
-            if (route.host == null && request.host == null) {
-                throw new SyntaxError(`No host provided in ${module.alias} route`);
-            }
             const helper = makeSecurityHelper(context);
-            const url = helper.makeUrl(route, path, { host: request.host, base: request.base, forceUnsecure: request.unsecure });
+            // The entrypoint answers where it lives — host, port, base, protocol and whether the hop is
+            // TLS — from its declaration and the service it names. A per-request host still overrides it.
+            const url = helper.makeUrl(module.address(), path, { host: request.host, base: request.base, forceUnsecure: request.unsecure });
             let transformer = undefined;
             let body = request.body != null && Object.entries((request.headers ?? {})).find(([key, value]) => key.toLowerCase() === 'content-type' && value?.includes('application/x-www-form-urlencoded')) ? qs.stringify(request.body) : request.body;
             // @TODO Probably this hack needs to be made a little bit less dirty
@@ -62,6 +62,23 @@ export const createApiService = (alias = DEFAULT_ALIAS) => {
                 const update = headers.get(TOKEN_UPDATE);
                 await auth.update(update == null || update === '' ? undefined : update);
             }
+            else if (response.status === UNAUTHORIZED_ERROR
+                && presented(request.headers)
+                && context.hasService(DEF_AUTH_SRV)) {
+                /**
+                 * A session the server has refused is not a session, and keeping it is worse than having
+                 * none: the application goes on rendering its signed-in tree over a credential that fails
+                 * every call it makes, and nothing on the client ever asks again — `authenticated()` reads
+                 * storage and decodes an envelope, it does not consult the server. What that leaves is an
+                 * app that looks signed in, works at nothing, and offers "Log out" where the control that
+                 * would fix it should be.
+                 *
+                 * Narrow on purpose. Only a request that actually PRESENTED this context's bearer counts,
+                 * so a 401 from an authentication attempt — bad code, wrong password, an expired challenge
+                 * — never clears the session of whoever is already signed in.
+                 */
+                await context.service(DEF_AUTH_SRV).update(undefined);
+            }
             processResponse(response, reply);
             return [reply.error ?? reply.value, reply.outcome];
         }

package/build/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEhE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAEtD,OAAO,KAAuB,MAAM,OAAO,CAAA;AAG3C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAEpD,OAAO,EAAE,MAAM,IAAI,CAAA;AACnB,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAQlE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAK,GAAW,aAAa,EAAa,EAAE;IAC3E,MAAM,QAAQ,GAAG,eAAe,KAAK,EAAE,CAAA;IACvC,MAAM,MAAM,GAAc,aAAa,CAAY,KAAK,EAAE;QACxD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAChC,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;gBAC9B,OAAM;YACR,CAAC;YACD,MAAM,OAAO,GAAG,aAAa,CAAkB,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;YACpE,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAmB,OAAO,CAAC,KAAK,CAAC,CAAA;YAClE,MAAM,MAAM,CAAC,OAAO,EAAE,CAAA;YACtB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAA;YAChC,IAAI,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAA;YAC3B,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;YAClC,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;gBAEnC,IAAI,OAAO,CAAC,MAAM,CAAC,KAAY,CAAC,IAAI,IAAI,EAAE,CAAC;oBACzC,MAAM,IAAI,WAAW,CAAC,sBAAsB,KAAK,EAAE,CAAC,CAAA;gBACtD,CAAC;gBACD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,KAAY,CAAC,EAAE,CAAC,CAAA;YACrE,CAAC,EAAE,IAAI,CAAC,CAAA;YACR,IAAI,KAAK,CAAC,IAAI,IAAI,IAAI,IAAI,OAAO,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;gBAC/C,MAAM,IAAI,WAAW,CAAC,uBAAuB,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAA;YACpE,CAAC;YAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAA;YAE1C,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;YAEpH,IAAI,WAAW,GAAwC,SAAS,CAAA;YAEhE,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAC7E,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CACf,GAAG,CAAC,WAAW,EAAE,KAAK,cAAc,IAAI,KAAK,EAAE,QAAQ,CAAC,mCAAmC,CAAC,CAC/F,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAA;YAE7C,oEAAoE;YACpE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,IAAI,EAAE,CAAC;gBAClE,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,cAAc,CAAC,EAAE,CAAC;oBACpF,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAA;oBACpD,qEAAqE;oBACrE,kEAAkE;oBAClE,WAAW,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAA;gBAC5B,CAAC;YACH,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC;gBACnC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM;gBACzB,MAAM,EAAE,OAAO,CAAC,KAAK;gBACrB,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,gBAAgB,EAAE,WAAW;gBAC7B,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI;gBAC1B,4EAA4E;gBAC5E,uEAAuE;gBACvE,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,6EAA6E;gBAC7E,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAA;YAEF,8EAA8E;YAC9E,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAuB,CAAA;YAChD,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAClE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAc,YAAY,CAAC,CAAA;gBACvD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAW,CAAA;gBAClD,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,IAAI,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;YACzE,CAAC;YAED,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;YAEhC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAQ,CAAA;QAC3D,CAAC;KACF,EAAE,OAAO,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE;QACvB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAAyC,GAAM,EAAE,KAAK,GAAW,aAAa,EAAK,EAAE;IAClH,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;IAEvC,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAE5B,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;QAC/B,GAAG,CAAC,GAAG,CAAC,UAAU,GAAG,KAAK,CAAA;IAC5B,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA"}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEhE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAEtD,OAAO,KAAuB,MAAM,OAAO,CAAA;AAG3C,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAEpD,OAAO,EAAE,MAAM,IAAI,CAAA;AACnB,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAG/E,qEAAqE;AACrE,MAAM,SAAS,GAAG,CAAC,OAAiC,EAAW,EAAE,CAC/D,OAAO,IAAI,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAC7C,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,WAAW,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE,CACrF,CAAA;AAOH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAK,GAAW,aAAa,EAAa,EAAE;IAC3E,MAAM,QAAQ,GAAG,eAAe,KAAK,EAAE,CAAA;IACvC,MAAM,MAAM,GAAc,aAAa,CAAY,KAAK,EAAE;QACxD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YAChC,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;gBAC9B,OAAM;YACR,CAAC;YACD,MAAM,OAAO,GAAG,aAAa,CAAkB,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;YACpE,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAmB,OAAO,CAAC,KAAK,CAAC,CAAA;YAClE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAA;YAChC,IAAI,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAA;YACxB,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;YAClC,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;gBAEnC,IAAI,OAAO,CAAC,MAAM,CAAC,KAAY,CAAC,IAAI,IAAI,EAAE,CAAC;oBACzC,MAAM,IAAI,WAAW,CAAC,sBAAsB,KAAK,EAAE,CAAC,CAAA;gBACtD,CAAC;gBACD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,KAAY,CAAC,EAAE,CAAC,CAAA;YACrE,CAAC,EAAE,IAAI,CAAC,CAAA;YAER,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAA;YAE1C,4FAA4F;YAC5F,8FAA8F;YAC9F,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CACxB,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EACtB,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,QAAQ,EAAE,CAC5E,CAAA;YAED,IAAI,WAAW,GAAwC,SAAS,CAAA;YAEhE,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAC7E,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CACf,GAAG,CAAC,WAAW,EAAE,KAAK,cAAc,IAAI,KAAK,EAAE,QAAQ,CAAC,mCAAmC,CAAC,CAC/F,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAA;YAE7C,oEAAoE;YACpE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,IAAI,EAAE,CAAC;gBAClE,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,cAAc,CAAC,EAAE,CAAC;oBACpF,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAA;oBACpD,qEAAqE;oBACrE,kEAAkE;oBAClE,WAAW,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAA;gBAC5B,CAAC;YACH,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC;gBACnC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM;gBACzB,MAAM,EAAE,OAAO,CAAC,KAAK;gBACrB,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,gBAAgB,EAAE,WAAW;gBAC7B,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI;gBAC1B,4EAA4E;gBAC5E,uEAAuE;gBACvE,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,6EAA6E;gBAC7E,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAA;YAEF,8EAA8E;YAC9E,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAuB,CAAA;YAChD,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAClE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAc,YAAY,CAAC,CAAA;gBACvD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAW,CAAA;gBAClD,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,IAAI,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;YACzE,CAAC;iBAAM,IACL,QAAQ,CAAC,MAAM,KAAK,kBAAkB;mBACnC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC;mBAC1B,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,EACnC,CAAC;gBACD;;;;;;;;;;;mBAWG;gBACH,MAAM,OAAO,CAAC,OAAO,CAAc,YAAY,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YACpE,CAAC;YAED,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;YAEhC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAQ,CAAA;QAC3D,CAAC;KACF,EAAE,OAAO,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE;QACvB,OAAO,CAAC,WAAW,GAAG,IAAI,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAAyC,GAAM,EAAE,KAAK,GAAW,aAAa,EAAK,EAAE;IAClH,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;IAEvC,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;IAE5B,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;QAC/B,GAAG,CAAC,GAAG,CAAC,UAAU,GAAG,KAAK,CAAA;IAC5B,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA"}

package/build/status/index.d.ts

@@ -0,0 +1,31 @@
+export { INCIDENT_ID_HEADER } from '../consts.js';
+export { DENIAL_KIND_HEADER, ACCESS_DENIED_KIND } from '../consts.js';
+export { API_CLIENT_MARKER, API_STATUS_MARKER, parseClientMarker } from './marker.js';
+export type { ClientMarker } from './marker.js';
+/** The HTTP status the API client stamps on an error it rebuilt from a response body. */
+export interface ResponseStatusCarrier {
+    responseStatus?: number;
+    denialKind?: string;
+}
+/** True only for a server-labelled auth/IAM refusal, never an unrelated 403. */
+export declare const isAccessDenied: (error: unknown) => boolean;
+/**
+ * The HTTP status an error answers to, or `null` when nothing states one.
+ *
+ * Read in order: the status the API client stamped on the error it rebuilt from a response
+ * (`responseStatus`); the status an `ApiClientError` parsed from its marker; the `httpStatus` its
+ * class declares — a 4xx always, a 5xx only with `allowServerErrorStatus`, exactly what an
+ * `@owlmeans/server-api` boundary answers with; finally an `api:client:*` marker in the message or
+ * the type of anything else. This is what lets a browser recognise a refusal from its status
+ * alone when a production body carries nothing but an incident id.
+ */
+export declare const httpStatusOf: (error: unknown) => number | null;
+/** The server's incident id carried by an error — its own field, else its marker — or `null`. */
+export declare const incidentIdOf: (error: unknown) => string | null;
+/**
+ * Whether a response body is a production incident body — the bare incident UUID an
+ * `@owlmeans/server-api` boundary sends instead of the marshaled error. A development body
+ * carries the `ResilientError` separator and is never one.
+ */
+export declare const isIncidentBody: (data: unknown) => data is string;
+//# sourceMappingURL=index.d.ts.map

package/build/status/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/status/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACjD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAErE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AACrF,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE/C,yFAAyF;AACzF,MAAM,WAAW,qBAAqB;IACpC,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,gFAAgF;AAChF,eAAO,MAAM,cAAc,UAAW,OAAO,KAAG,OAGuB,CAAA;AAavE;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,UAAW,OAAO,KAAG,MAAM,GAAG,IAkBtD,CAAA;AAED,iGAAiG;AACjG,eAAO,MAAM,YAAY,UAAW,OAAO,KAAG,MAAM,GAAG,IAUtD,CAAA;AAID;;;;GAIG;AACH,eAAO,MAAM,cAAc,SAAU,OAAO,KAAG,IAAI,IAAI,MACyC,CAAA"}

package/build/status/index.js

@@ -0,0 +1,65 @@
+import { ResilientError } from '@owlmeans/error';
+import { ApiClientError } from '../errors.js';
+import { parseClientMarker } from './marker.js';
+export { INCIDENT_ID_HEADER } from '../consts.js';
+export { DENIAL_KIND_HEADER, ACCESS_DENIED_KIND } from '../consts.js';
+import { ACCESS_DENIED_KIND } from '../consts.js';
+export { API_CLIENT_MARKER, API_STATUS_MARKER, parseClientMarker } from './marker.js';
+/** True only for a server-labelled auth/IAM refusal, never an unrelated 403. */
+export const isAccessDenied = (error) => httpStatusOf(error) === 403
+    && typeof error === 'object' && error != null
+    && error.denialKind === ACCESS_DENIED_KIND;
+const httpStatus = (value) => typeof value === 'number' && Number.isInteger(value) && value >= 100 && value <= 599 ? value : null;
+/** The first `api:client:*` marker in an error's `message`, else in its `type`. */
+const markerOf = (error) => {
+    const { message, type } = error;
+    return (typeof message === 'string' ? parseClientMarker(message) : null)
+        ?? (typeof type === 'string' ? parseClientMarker(type) : null);
+};
+/**
+ * The HTTP status an error answers to, or `null` when nothing states one.
+ *
+ * Read in order: the status the API client stamped on the error it rebuilt from a response
+ * (`responseStatus`); the status an `ApiClientError` parsed from its marker; the `httpStatus` its
+ * class declares — a 4xx always, a 5xx only with `allowServerErrorStatus`, exactly what an
+ * `@owlmeans/server-api` boundary answers with; finally an `api:client:*` marker in the message or
+ * the type of anything else. This is what lets a browser recognise a refusal from its status
+ * alone when a production body carries nothing but an incident id.
+ */
+export const httpStatusOf = (error) => {
+    if (error == null || typeof error !== 'object') {
+        return null;
+    }
+    const stamped = httpStatus(error.responseStatus);
+    if (stamped != null) {
+        return stamped;
+    }
+    if (error instanceof ApiClientError && httpStatus(error.status) != null) {
+        return error.status;
+    }
+    const declaration = error.constructor;
+    const declared = httpStatus(declaration?.httpStatus);
+    if (declared != null && (declared < 500 || declaration?.allowServerErrorStatus === true)) {
+        return declared;
+    }
+    return markerOf(error)?.status ?? null;
+};
+/** The server's incident id carried by an error — its own field, else its marker — or `null`. */
+export const incidentIdOf = (error) => {
+    if (error == null || typeof error !== 'object') {
+        return null;
+    }
+    const own = error.incidentId;
+    if (typeof own === 'string' && own !== '') {
+        return own;
+    }
+    return markerOf(error)?.incidentId ?? null;
+};
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * Whether a response body is a production incident body — the bare incident UUID an
+ * `@owlmeans/server-api` boundary sends instead of the marshaled error. A development body
+ * carries the `ResilientError` separator and is never one.
+ */
+export const isIncidentBody = (data) => typeof data === 'string' && !data.includes(ResilientError.separator) && UUID.test(data.trim());
+//# sourceMappingURL=index.js.map

package/build/status/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/status/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAE/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACjD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACjD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AASrF,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAc,EAAW,EAAE,CACxD,YAAY,CAAC,KAAK,CAAC,KAAK,GAAG;OACxB,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,IAAI,IAAI;OACzC,KAA+B,CAAC,UAAU,KAAK,kBAAkB,CAAA;AAEvE,MAAM,UAAU,GAAG,CAAC,KAAc,EAAiB,EAAE,CACnD,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,GAAG,IAAI,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AAErG,mFAAmF;AACnF,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAE,EAAE;IACjC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAA8C,CAAA;IAExE,OAAO,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;WACnE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;AAClE,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAc,EAAiB,EAAE;IAC5D,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAE,KAA+B,CAAC,cAAc,CAAC,CAAA;IAC3E,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;QACpB,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,IAAI,KAAK,YAAY,cAAc,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACxE,OAAO,KAAK,CAAC,MAAO,CAAA;IACtB,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAqF,CAAA;IAC/G,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;IACpD,IAAI,QAAQ,IAAI,IAAI,IAAI,CAAC,QAAQ,GAAG,GAAG,IAAI,WAAW,EAAE,sBAAsB,KAAK,IAAI,CAAC,EAAE,CAAC;QACzF,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,OAAO,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,IAAI,CAAA;AACxC,CAAC,CAAA;AAED,iGAAiG;AACjG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAc,EAAiB,EAAE;IAC5D,IAAI,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,GAAG,GAAI,KAAkC,CAAC,UAAU,CAAA;IAC1D,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAC1C,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,OAAO,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,IAAI,IAAI,CAAA;AAC5C,CAAC,CAAA;AAED,MAAM,IAAI,GAAG,iEAAiE,CAAA;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAa,EAAkB,EAAE,CAC9D,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA"}

package/build/status/marker.d.ts

@@ -0,0 +1,12 @@
+/** The prefix every `ApiClientError` message carries. */
+export declare const API_CLIENT_MARKER = "api:client:";
+/** The marker of an `ApiStatusError`: `api:client:status:<n>[:<incident id>]`. */
+export declare const API_STATUS_MARKER = "api:client:status:";
+/** What an `api:client:*` marker states. */
+export interface ClientMarker {
+    status?: number;
+    incidentId?: string;
+}
+/** Read the first `api:client:*` marker in a text, or `null` when it carries none. */
+export declare const parseClientMarker: (text: string) => ClientMarker | null;
+//# sourceMappingURL=marker.d.ts.map

package/build/status/marker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"marker.d.ts","sourceRoot":"","sources":["../../src/status/marker.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,eAAO,MAAM,iBAAiB,gBAAgB,CAAA;AAE9C,kFAAkF;AAClF,eAAO,MAAM,iBAAiB,uBAAgC,CAAA;AAY9D,4CAA4C;AAC5C,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,sFAAsF;AACtF,eAAO,MAAM,iBAAiB,SAAU,MAAM,KAAG,YAAY,GAAG,IAa/D,CAAA"}