@sinequa/atomic 2.1.0 → 2.3.0

package/README.md

@@ -80,6 +80,25 @@ Call `initializeAadHttpClient(null)` to detach the client (e.g. in `onDispose`).
 
 ## Modules
 
+### Client (experimental)
+
+`createAtomicClient(config)` returns an isolated client — its own configuration, session and event
+subscribers — exposing `client.config`, `client.auth` and `client.http`. Several clients can target
+different backends from the same page, and each takes its `fetch`/`storage`/`logger` as
+configuration, which removes the need for module mocks in tests.
+
+```typescript
+import { createAtomicClient } from '@sinequa/atomic';
+
+const client = createAtomicClient({ app: 'myapp', backendUrl: 'https://backend' });
+client.auth.on('unauthorized', () => client.auth.login());
+const results = await client.http.post('api/v1/search.query', { text: 'hello' });
+```
+
+The free functions below keep working unchanged: they run on a default client whose configuration
+**is** `globalConfig`, and `getDefaultClient()` hands back that very instance — useful from code
+that cannot receive one (a distributed web component, a plugin).
+
 ### Authentication
 
 Full auth lifecycle — from first handshake to logout.
@@ -95,6 +114,14 @@ Full auth lifecycle — from first handshake to logout.
 | `getJWToken(credentials?)` | Fetches a JWT from the server, returns the CSRF token |
 | `getCsrfToken()` | CSRF token for mutating requests |
 | `deleteWebTokenCookie()` | Explicitly removes the web token cookie |
+| `onAuthEvent(event, handler)` | Typed subscription to the auth lifecycle (`authenticated`, `unauthorized`, `tokenRefreshed`, `loggedOut`) — returns the unsubscribe function |
+| `tryAutoAuthentication()` | Probes the server for auto-authentication (OIDC) — used by `login()` in `unknown` mode |
+| `tryOAuthAuthentication()` / `trySAMLAuthentication()` | Redirect to the configured identity provider (with a one-shot redirect-loop guard) |
+| `emitAuthenticatedEvent(bool)` | Dispatches the DOM `'authenticated'` CustomEvent (on `document`, bubbles to `window`) |
+
+The authentication layer is configurable via `setGlobalConfig({ auth: { … } })` (`AuthOptions`):
+request timeout, auto-auth probe endpoint, injectable storage/logger/fetch, and the requests'
+`credentials` mode.
 
 ```typescript
 import { isAuthenticated, login, logout } from '@sinequa/atomic';
@@ -276,7 +303,7 @@ console.log(globalConfig.backendUrl, globalConfig.authMode.kind);
 ## Testing
 
 ```bash
-npm test          # run vitest (287 test cases across 25 files)
+npm test          # run the vitest suite
 npm test -- --ui  # interactive UI
 ```
 

package/dist/atomic.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./src-CGNARSYI.cjs");exports.API=e.F,exports.ApiError=e.Ut,exports.Audit=e.$,exports.AuditEventType=e.wt,exports.AuthMode=e.Dn,exports.DidYouMeanKind=e.bt,exports.EngineType=e.Ct,exports.EngineTypeModifier=e.St,exports.LogLevel=e.rn,exports.MINIMUM_COMPATIBLE_SERVER_API_VERSION=e.xt,exports.RFMDisplay=e.yt,exports.ServerError=e.Ht,exports.TimeoutError=e.Vt,exports.UnauthorizedError=e.Bt,exports.addAuditAdditionalInfo=e.et,exports.addConcepts=e.fn,exports.addSessionId=e.tt,exports.addUrl=e.nt,exports.aggItemRegex=e.yn,exports.aggregationItemStrictCompare=e.bn,exports.appInitializerFn=e.q,exports.bisect=e.vn,exports.buildPathsAndLevels=e.M,exports.clearSessionTokens=e.n,exports.configureLogger=e.in,exports.createHeaders=e.Wt,exports.createTimeoutController=e.At,exports.createUserProfile=e.m,exports.debug=e.an,exports.del=e.Ft,exports.deleteUserProfileProperty=e.h,exports.deleteUserSettings=e.b,exports.deleteWebTokenCookie=e.i,exports.detectAuthMode=e.Z,exports.emitAuthenticatedEvent=e.kn,exports.error=e.on,exports.escapeExpr=e.rt,exports.expiresSoon=e.Dt,exports.extraColumns=e._t,exports.fetchAggregation=e.Q,exports.fetchApp=e.J,exports.fetchAppPreLogin=e.Y,exports.fetchBulkQuery=e.N,exports.fetchChangePassword=e.y,exports.fetchDataset=e.W,exports.fetchDatasetList=e.G,exports.fetchDatasets=e.K,exports.fetchLabels=e.H,exports.fetchPreview=e.B,exports.fetchPreviewUrl=e.V,exports.fetchPrincipal=e.I,exports.fetchPrincipalList=e.L,exports.fetchPrincipalUserid=e.R,exports.fetchPrincipalUserids=e.z,exports.fetchQuery=e.P,exports.fetchQueryExport=e.j,exports.fetchQueryIntent=e.A,exports.fetchSendPasswordResetEmail=e.v,exports.fetchSimilarDocuments=e.k,exports.fetchSponsoredLinks=e.O,exports.fetchSuggest=e.T,exports.fetchSuggestField=e.E,exports.fetchSuggestQuery=e.D,exports.fetchTextChunks=e.w,exports.fetchUserProfile=e.g,exports.fetchUserSettings=e.x,exports.fetchVersion=e.p,exports.filter=e.ht,exports.get=e.Pt,exports.getConcepts=e.pn,exports.getCsrfToken=e.l,exports.getFiltersFromURI=e.qt,exports.getFiltersFromUrl=e.Jt,exports.getHelpIndexUrl=e.Gt,exports.getIdFromUrl=e.Yt,exports.getJWToken=e.c,exports.getMetadata=e.pt,exports.getMetadataWithValues=e.mt,exports.getOffsetFromDates=e.un,exports.getQueryPageFromUrl=e.Xt,exports.getQueryParamsFromUrl=e.Zt,exports.getQueryTabFromUrl=e.Qt,exports.getQueryTextFromUrl=e.$t,exports.getRelativeDate=e.dn,exports.getTime=e.it,exports.getToken=e.s,exports.getUrlParamsFromQueryParams=e.en,exports.globalConfig=e.Tn,exports.guid=e.at,exports.handleResponse=e.zt,exports.info=e.sn,exports.initializeAppConfig=e.X,exports.isArrayBuffer=e.ot,exports.isAuthenticated=e.t,exports.isBlob=e.st,exports.isDate=e.ct,exports.isExpired=e.Ot,exports.isJsonable=e.lt,exports.isNotInputEvent=e.ln,exports.isObject=e.ut,exports.isString=e.dt,exports.labels=e.U,exports.legacyBooleansToAuthMode=e.On,exports.legacyFilterToFilter=e.gt,exports.login=e.a,exports.logout=e.r,exports.makeColumn=e.vt,exports.notify=e.nn,exports.openParentNodes=e.xn,exports.parseText=e.mn,exports.parseValueAndOperatorFromItem=e.Sn,exports.patch=e.Nt,exports.patchUserProfile=e._,exports.patchUserSettings=e.S,exports.post=e.Mt,exports.put=e.jt,exports.queryParamsFromUrl=e.tn,exports.removeConcept=e.hn,exports.removeConcepts=e.gn,exports.resolveNoAutoAuthentication=e.It,exports.resolveToColumnName=e.Tt,exports.rewriteText=e._n,exports.saveUserSettings=e.C,exports.setGlobalConfig=e.En,exports.setToken=e.u,exports.sha512=e.ft,exports.suggestionsToTreeAggregationNodes=e.Cn,exports.sysLang=e.Kt,exports.toDate=e.kt,exports.translateAggregationToDateOptions=e.wn,exports.tryAutoAuthentication=e.o,exports.tryOAuthAuthentication=e.f,exports.trySAMLAuthentication=e.d,exports.warn=e.cn,exports.withRetry=e.Et;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./src-1RUu1uXc.cjs");exports.API=e.st,exports.ApiError=e.In,exports.Audit=e.bt,exports.AuditEventType=e.Kt,exports.AuthMode=e.qn,exports.DidYouMeanKind=e.Ht,exports.EngineType=e.Gt,exports.EngineTypeModifier=e.Wt,exports.LogLevel=e.$n,exports.MINIMUM_COMPATIBLE_SERVER_API_VERSION=e.Ut,exports.RFMDisplay=e.Vt,exports.ServerError=e.Nn,exports.TimeoutError=e.En,exports.UnauthorizedError=e.Fn,exports.addAuditAdditionalInfo=e.xt,exports.addConcepts=e.g,exports.addSessionId=e.St,exports.addUrl=e.Ct,exports.aggItemRegex=e.C,exports.aggregationItemStrictCompare=e.w,exports.appInitializerFn=e.Qt,exports.applyConfig=e.Wn,exports.assertNever=e._n,exports.bisect=e.S,exports.buildPathsAndLevels=e.it,exports.clearSessionTokens=e.un,exports.configureLogger=e.er,exports.createAtomicClient=e.k,exports.createContainer=e.L,exports.createHeaders=e.Ln,exports.createHeadersWithContext=e.Rn,exports.createTimeoutController=e.Tn,exports.createUserProfile=e.M,Object.defineProperty(exports,"debug",{enumerable:!0,get:function(){return e.tr}}),exports.del=e.on,exports.delWithContext=e.sn,exports.deleteContainerDocuments=e.R,exports.deleteContainers=e.z,exports.deleteUserProfileProperty=e.N,exports.deleteUserSettings=e.G,exports.deleteWebTokenCookie=e.fn,exports.detectAuthMode=e.Sn,exports.emitAuthenticatedEvent=e.Bn,Object.defineProperty(exports,"error",{enumerable:!0,get:function(){return e.nr}}),exports.escapeExpr=e.wt,exports.expiresSoon=e.Yt,exports.extraColumns=e.zt,exports.fetchAggregation=e.yt,exports.fetchApp=e.$t,exports.fetchAppPreLogin=e.en,exports.fetchBulkQuery=e.at,exports.fetchChangePassword=e.W,exports.fetchDataset=e.gt,exports.fetchDatasetList=e._t,exports.fetchDatasets=e.vt,exports.fetchLabels=e.mt,exports.fetchPreview=e.ft,exports.fetchPreviewUrl=e.pt,exports.fetchPrincipal=e.ct,exports.fetchPrincipalList=e.lt,exports.fetchPrincipalUserid=e.ut,exports.fetchPrincipalUserids=e.dt,exports.fetchQuery=e.ot,exports.fetchQueryExport=e.rt,exports.fetchQueryIntent=e.nt,exports.fetchSendPasswordResetEmail=e.I,exports.fetchSimilarDocuments=e.et,exports.fetchSponsoredLinks=e.$,exports.fetchSuggest=e.X,exports.fetchSuggestField=e.Z,exports.fetchSuggestQuery=e.Q,exports.fetchTextChunks=e.Y,exports.fetchUserProfile=e.P,exports.fetchUserSettings=e.K,exports.fetchVersion=e.j,exports.filter=e.Lt,exports.get=e.bn,exports.getConcepts=e._,exports.getContainer=e.B,exports.getCsrfToken=e.yn,exports.getDefaultClient=e.A,exports.getFiltersFromURI=e.r,exports.getFiltersFromUrl=e.i,exports.getHelpIndexUrl=e.t,exports.getIdFromUrl=e.a,exports.getJWToken=e.hn,exports.getMetadata=e.Ft,exports.getMetadataWithValues=e.It,exports.getOffsetFromDates=e.m,exports.getQueryPageFromUrl=e.o,exports.getQueryParamsFromUrl=e.s,exports.getQueryTabFromUrl=e.c,exports.getQueryTextFromUrl=e.l,exports.getRelativeDate=e.h,exports.getTime=e.Tt,exports.getToken=e.zn,exports.getUrlParamsFromQueryParams=e.u,exports.getWithContext=e.xn,exports.globalConfig=e.Gn,exports.guid=e.Et,exports.handleResponse=e.jn,exports.handleResponseWithContext=e.Mn,exports.hasSession=e.vn,Object.defineProperty(exports,"info",{enumerable:!0,get:function(){return e.rr}}),exports.initializeAppConfig=e.tn,exports.isArrayBuffer=e.Dt,exports.isAuthenticated=e.cn,exports.isBlob=e.Ot,exports.isDate=e.kt,exports.isExpired=e.Xt,exports.isExternalAuthMode=e.Jn,exports.isJsonable=e.At,exports.isNotInputEvent=e.p,exports.isObject=e.jt,exports.isRedirectPending=e.ln,exports.isString=e.Mt,exports.labels=e.ht,exports.legacyBooleansToAuthMode=e.Yn,exports.legacyFilterToFilter=e.Rt,exports.listContainerDocuments=e.V,exports.listContainers=e.H,exports.login=e.pn,exports.logout=e.dn,exports.makeColumn=e.Bt,exports.notify=e.f,exports.onAuthEvent=e.ar,exports.openParentNodes=e.T,exports.parseText=e.v,exports.parseValueAndOperatorFromItem=e.E,exports.patch=e.in,exports.patchUserProfile=e.F,exports.patchUserSettings=e.q,exports.patchWithContext=e.an,exports.post=e.Dn,exports.postWithContext=e.On,exports.put=e.nn,exports.putWithContext=e.rn,exports.queryParamsFromUrl=e.d,exports.removeConcept=e.y,exports.removeConcepts=e.b,exports.requestWebTokenSession=e.gn,exports.resolveBearerToken=e.Xn,exports.resolveNoAutoAuthentication=e.kn,exports.resolveNoAutoAuthenticationWithContext=e.An,exports.resolveOAuthProvider=e.Zn,exports.resolveSAMLProvider=e.Qn,exports.resolveToColumnName=e.qt,exports.resultPages=e.Pt,exports.rewriteText=e.x,exports.saveUserSettings=e.J,exports.searchPrincipals=e.tt,exports.setGlobalConfig=e.Kn,exports.setToken=e.Pn,exports.sha512=e.Nt,exports.suggestionsToTreeAggregationNodes=e.D,exports.sysLang=e.n,exports.toDate=e.Zt,exports.translateAggregationToDateOptions=e.O,exports.tryAutoAuthentication=e.mn,exports.tryOAuthAuthentication=e.wn,exports.trySAMLAuthentication=e.Cn,exports.updateContainer=e.U,Object.defineProperty(exports,"warn",{enumerable:!0,get:function(){return e.ir}}),exports.withRetry=e.Jt;

package/dist/atomic.js

@@ -1,2 +1,2 @@
-import { $ as e, $t as t, A as n, At as r, B as i, Bt as a, C as o, Cn as s, Ct as c, D as l, Dn as u, Dt as d, E as f, En as p, Et as m, F as h, Ft as g, G as _, Gt as v, H as y, Ht as b, I as x, It as S, J as C, Jt as w, K as T, Kt as E, L as D, M as O, Mt as k, N as A, Nt as j, O as M, On as N, Ot as P, P as F, Pt as I, Q as L, Qt as R, R as z, S as B, Sn as V, St as H, T as U, Tn as W, Tt as G, U as K, Ut as q, V as J, Vt as Y, W as X, Wt as Z, X as Q, Xt as $, Y as ee, Yt as te, Z as ne, Zt as re, _ as ie, _n as ae, _t as oe, a as se, an as ce, at as le, b as ue, bn as de, bt as fe, c as pe, cn as me, ct as he, d as ge, dn as _e, dt as ve, en as ye, et as be, f as xe, fn as Se, ft as Ce, g as we, gn as Te, gt as Ee, h as De, hn as Oe, ht as ke, i as Ae, in as je, it as Me, j as Ne, jt as Pe, k as Fe, kn as Ie, kt as Le, l as Re, ln as ze, lt as Be, m as Ve, mn as He, mt as Ue, n as We, nn as Ge, nt as Ke, o as qe, on as Je, ot as Ye, p as Xe, pn as Ze, pt as Qe, q as $e, qt as et, r as tt, rn as nt, rt, s as it, sn as at, st as ot, t as st, tn as ct, tt as lt, u as ut, un as dt, ut as ft, v as pt, vn as mt, vt as ht, w as gt, wn as _t, wt as vt, x as yt, xn as bt, xt, y as St, yn as Ct, yt as wt, z as Tt, zt as Et } from "./src-C3yJArxW.js";
-export { h as API, q as ApiError, e as Audit, vt as AuditEventType, u as AuthMode, fe as DidYouMeanKind, c as EngineType, H as EngineTypeModifier, nt as LogLevel, xt as MINIMUM_COMPATIBLE_SERVER_API_VERSION, wt as RFMDisplay, b as ServerError, Y as TimeoutError, a as UnauthorizedError, be as addAuditAdditionalInfo, Se as addConcepts, lt as addSessionId, Ke as addUrl, Ct as aggItemRegex, de as aggregationItemStrictCompare, $e as appInitializerFn, mt as bisect, O as buildPathsAndLevels, We as clearSessionTokens, je as configureLogger, Z as createHeaders, r as createTimeoutController, Ve as createUserProfile, ce as debug, g as del, De as deleteUserProfileProperty, ue as deleteUserSettings, Ae as deleteWebTokenCookie, ne as detectAuthMode, Ie as emitAuthenticatedEvent, Je as error, rt as escapeExpr, d as expiresSoon, oe as extraColumns, L as fetchAggregation, C as fetchApp, ee as fetchAppPreLogin, A as fetchBulkQuery, St as fetchChangePassword, X as fetchDataset, _ as fetchDatasetList, T as fetchDatasets, y as fetchLabels, i as fetchPreview, J as fetchPreviewUrl, x as fetchPrincipal, D as fetchPrincipalList, z as fetchPrincipalUserid, Tt as fetchPrincipalUserids, F as fetchQuery, Ne as fetchQueryExport, n as fetchQueryIntent, pt as fetchSendPasswordResetEmail, Fe as fetchSimilarDocuments, M as fetchSponsoredLinks, U as fetchSuggest, f as fetchSuggestField, l as fetchSuggestQuery, gt as fetchTextChunks, we as fetchUserProfile, yt as fetchUserSettings, Xe as fetchVersion, ke as filter, I as get, Ze as getConcepts, Re as getCsrfToken, et as getFiltersFromURI, w as getFiltersFromUrl, v as getHelpIndexUrl, te as getIdFromUrl, pe as getJWToken, Qe as getMetadata, Ue as getMetadataWithValues, dt as getOffsetFromDates, $ as getQueryPageFromUrl, re as getQueryParamsFromUrl, R as getQueryTabFromUrl, t as getQueryTextFromUrl, _e as getRelativeDate, Me as getTime, it as getToken, ye as getUrlParamsFromQueryParams, W as globalConfig, le as guid, Et as handleResponse, at as info, Q as initializeAppConfig, Ye as isArrayBuffer, st as isAuthenticated, ot as isBlob, he as isDate, P as isExpired, Be as isJsonable, ze as isNotInputEvent, ft as isObject, ve as isString, K as labels, N as legacyBooleansToAuthMode, Ee as legacyFilterToFilter, se as login, tt as logout, ht as makeColumn, Ge as notify, bt as openParentNodes, He as parseText, V as parseValueAndOperatorFromItem, j as patch, ie as patchUserProfile, B as patchUserSettings, k as post, Pe as put, ct as queryParamsFromUrl, Oe as removeConcept, Te as removeConcepts, S as resolveNoAutoAuthentication, G as resolveToColumnName, ae as rewriteText, o as saveUserSettings, p as setGlobalConfig, ut as setToken, Ce as sha512, s as suggestionsToTreeAggregationNodes, E as sysLang, Le as toDate, _t as translateAggregationToDateOptions, qe as tryAutoAuthentication, xe as tryOAuthAuthentication, ge as trySAMLAuthentication, me as warn, m as withRetry };
+import { $ as e, $n as t, $t as n, A as r, An as i, At as a, B as o, Bn as s, Bt as c, C as l, Cn as u, Ct as d, D as f, Dn as p, Dt as m, E as h, En as g, Et as _, F as v, Fn as y, Ft as b, G as x, Gn as S, Gt as C, H as w, Ht as T, I as E, In as D, It as O, J as k, Jn as A, Jt as j, K as M, Kn as N, Kt as P, L as F, Ln as I, Lt as L, M as R, Mn as z, Mt as B, N as V, Nn as H, Nt as U, O as W, On as G, Ot as K, P as q, Pn as J, Pt as Y, Q as X, Qn as Z, Qt as Q, R as $, Rn as ee, Rt as te, S as ne, Sn as re, St as ie, T as ae, Tn as oe, Tt as se, U as ce, Ut as le, V as ue, Vt as de, W as fe, Wn as pe, Wt as me, X as he, Xn as ge, Xt as _e, Y as ve, Yn as ye, Yt as be, Z as xe, Zn as Se, Zt as Ce, _ as we, _n as Te, _t as Ee, a as De, an as Oe, ar as ke, at as Ae, b as je, bn as Me, bt as Ne, c as Pe, cn as Fe, ct as Ie, d as Le, dn as Re, dt as ze, en as Be, er as Ve, et as He, f as Ue, fn as We, ft as Ge, g as Ke, gn as qe, gt as Je, h as Ye, hn as Xe, ht as Ze, i as Qe, in as $e, ir as et, it as tt, j as nt, jn as rt, jt as it, k as at, kn as ot, kt as st, l as ct, ln as lt, lt as ut, m as dt, mn as ft, mt as pt, n as mt, nn as ht, nr as gt, nt as _t, o as vt, on as yt, ot as bt, p as xt, pn as St, pt as Ct, q as wt, qn as Tt, qt as Et, r as Dt, rn as Ot, rr as kt, rt as At, s as jt, sn as Mt, st as Nt, t as Pt, tn as Ft, tr as It, tt as Lt, u as Rt, un as zt, ut as Bt, v as Vt, vn as Ht, vt as Ut, w as Wt, wn as Gt, wt as Kt, x as qt, xn as Jt, xt as Yt, y as Xt, yn as Zt, yt as Qt, z as $t, zn as en, zt as tn } from "./src-DFuZeDvd.js";
+export { Nt as API, D as ApiError, Ne as Audit, P as AuditEventType, Tt as AuthMode, T as DidYouMeanKind, C as EngineType, me as EngineTypeModifier, t as LogLevel, le as MINIMUM_COMPATIBLE_SERVER_API_VERSION, de as RFMDisplay, H as ServerError, g as TimeoutError, y as UnauthorizedError, Yt as addAuditAdditionalInfo, Ke as addConcepts, ie as addSessionId, d as addUrl, l as aggItemRegex, Wt as aggregationItemStrictCompare, Q as appInitializerFn, pe as applyConfig, Te as assertNever, ne as bisect, tt as buildPathsAndLevels, zt as clearSessionTokens, Ve as configureLogger, at as createAtomicClient, F as createContainer, I as createHeaders, ee as createHeadersWithContext, oe as createTimeoutController, R as createUserProfile, It as debug, yt as del, Mt as delWithContext, $ as deleteContainerDocuments, $t as deleteContainers, V as deleteUserProfileProperty, x as deleteUserSettings, We as deleteWebTokenCookie, re as detectAuthMode, s as emitAuthenticatedEvent, gt as error, Kt as escapeExpr, be as expiresSoon, tn as extraColumns, Qt as fetchAggregation, n as fetchApp, Be as fetchAppPreLogin, Ae as fetchBulkQuery, fe as fetchChangePassword, Je as fetchDataset, Ee as fetchDatasetList, Ut as fetchDatasets, pt as fetchLabels, Ge as fetchPreview, Ct as fetchPreviewUrl, Ie as fetchPrincipal, ut as fetchPrincipalList, Bt as fetchPrincipalUserid, ze as fetchPrincipalUserids, bt as fetchQuery, At as fetchQueryExport, _t as fetchQueryIntent, E as fetchSendPasswordResetEmail, He as fetchSimilarDocuments, e as fetchSponsoredLinks, he as fetchSuggest, xe as fetchSuggestField, X as fetchSuggestQuery, ve as fetchTextChunks, q as fetchUserProfile, M as fetchUserSettings, nt as fetchVersion, L as filter, Me as get, we as getConcepts, o as getContainer, Zt as getCsrfToken, r as getDefaultClient, Dt as getFiltersFromURI, Qe as getFiltersFromUrl, Pt as getHelpIndexUrl, De as getIdFromUrl, Xe as getJWToken, b as getMetadata, O as getMetadataWithValues, dt as getOffsetFromDates, vt as getQueryPageFromUrl, jt as getQueryParamsFromUrl, Pe as getQueryTabFromUrl, ct as getQueryTextFromUrl, Ye as getRelativeDate, se as getTime, en as getToken, Rt as getUrlParamsFromQueryParams, Jt as getWithContext, S as globalConfig, _ as guid, rt as handleResponse, z as handleResponseWithContext, Ht as hasSession, kt as info, Ft as initializeAppConfig, m as isArrayBuffer, Fe as isAuthenticated, K as isBlob, st as isDate, _e as isExpired, A as isExternalAuthMode, a as isJsonable, xt as isNotInputEvent, it as isObject, lt as isRedirectPending, B as isString, Ze as labels, ye as legacyBooleansToAuthMode, te as legacyFilterToFilter, ue as listContainerDocuments, w as listContainers, St as login, Re as logout, c as makeColumn, Ue as notify, ke as onAuthEvent, ae as openParentNodes, Vt as parseText, h as parseValueAndOperatorFromItem, $e as patch, v as patchUserProfile, wt as patchUserSettings, Oe as patchWithContext, p as post, G as postWithContext, ht as put, Ot as putWithContext, Le as queryParamsFromUrl, Xt as removeConcept, je as removeConcepts, qe as requestWebTokenSession, ge as resolveBearerToken, ot as resolveNoAutoAuthentication, i as resolveNoAutoAuthenticationWithContext, Se as resolveOAuthProvider, Z as resolveSAMLProvider, Et as resolveToColumnName, Y as resultPages, qt as rewriteText, k as saveUserSettings, Lt as searchPrincipals, N as setGlobalConfig, J as setToken, U as sha512, f as suggestionsToTreeAggregationNodes, mt as sysLang, Ce as toDate, W as translateAggregationToDateOptions, ft as tryAutoAuthentication, Gt as tryOAuthAuthentication, u as trySAMLAuthentication, ce as updateContainer, et as warn, j as withRetry };

package/dist/authentication/constants.d.ts

@@ -1,7 +1,27 @@
+import { type AtomicContext } from "../client/atomic-context";
 /**
  * Default timeout in milliseconds for all authentication network requests.
+ * Override it per application via `setGlobalConfig({ auth: { timeoutMs } })`.
  */
 export declare const AUTH_TIMEOUT_MS = 10000;
+/** The auth request timeout of a context: its configured `auth.timeoutMs`, or the default. */
+export declare const getAuthTimeoutMsWithContext: (ctx: AtomicContext) => number;
+/** The effective auth request timeout: the configured `auth.timeoutMs`, or the default. */
+export declare const getAuthTimeoutMs: () => number;
+/**
+ * Web Storage keys used by the authentication layer — single source of truth (they used to be
+ * duplicated as string literals across the token/session modules).
+ */
+export declare const STORAGE_KEYS: {
+    /** sessionStorage — JSON envelope holding the CSRF token (see `setToken`/`getToken`). */
+    readonly credentials: "sinequa-credentials";
+    /** localStorage — legacy location of the CSRF token: still read and cleared, never written. */
+    readonly legacyCsrfToken: "csrfToken";
+    /** sessionStorage — token-less authenticated flag (ambient SSO: IIS/proxy). */
+    readonly authenticated: "sinequa-authenticated";
+    /** localStorage — marker of the last successful credentials login (disambiguates `unknown`). */
+    readonly lastAuthMode: "sinequa-last-auth-mode";
+};
 /**
  * Session-storage key marking that a provider redirect (OAuth/SAML) has already been initiated.
  * Used as a one-shot loop guard: if we come back from the provider still without a session, we must

package/dist/authentication/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/authentication/constants.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,eAAO,MAAM,eAAe,QAAS,CAAC;AAEtC;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,kCAAkC,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/authentication/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAkB,MAAM,0BAA0B,CAAC;AAE9E;;;GAGG;AACH,eAAO,MAAM,eAAe,QAAS,CAAC;AAEtC,8FAA8F;AAC9F,eAAO,MAAM,2BAA2B,GAAI,KAAK,aAAa,KAAG,MAClB,CAAC;AAEhD,2FAA2F;AAC3F,eAAO,MAAM,gBAAgB,QAAO,MACS,CAAC;AAE9C;;;GAGG;AACH,eAAO,MAAM,YAAY;IACvB,yFAAyF;;IAEzF,+FAA+F;;IAE/F,+EAA+E;;IAE/E,gGAAgG;;CAExF,CAAC;AAEX;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,kCAAkC,CAAC"}

package/dist/authentication/events/auth-events.d.ts

@@ -0,0 +1,71 @@
+import type { ApiError } from "../../web-api/helpers/errors/api-error";
+import type { UnauthorizedError } from "../../web-api/helpers/errors/unauthorized-error";
+/**
+ * Typed client events and their payloads.
+ *
+ * - `authenticated` — the authentication state changed (mirrors the DOM `authenticated` event);
+ * - `unauthorized` — a request was rejected with a 401 (fires just before the
+ *   {@link UnauthorizedError} is thrown). Use it to **observe**; to actually recover the session
+ *   and have the request replayed, configure `auth.recoverFromUnauthorized` instead;
+ * - `requestFailed` — any request that ended on an error status, 401 included. The place to
+ *   surface a notification without wrapping every call site;
+ * - `tokenRefreshed` — the CSRF token was stored or refreshed (`sinequa-jwt-refresh` header);
+ * - `loggedOut` — an explicit `logout()` completed its local cleanup.
+ */
+export type AuthEventMap = {
+    authenticated: {
+        authenticated: boolean;
+    };
+    unauthorized: {
+        endpoint: string;
+        error: UnauthorizedError;
+    };
+    requestFailed: {
+        endpoint: string;
+        status: number;
+        error: ApiError;
+    };
+    tokenRefreshed: {
+        token: string;
+    };
+    loggedOut: Record<string, never>;
+};
+export type AuthEventName = keyof AuthEventMap;
+/** Detaches the handler registered by {@link onAuthEvent}. */
+export type Unsubscribe = () => void;
+/**
+ * A set of authentication-event subscribers. Each client owns one, so events raised by a client
+ * only reach the handlers registered on that client.
+ */
+export interface AuthEventBus {
+    on<K extends AuthEventName>(event: K, handler: (payload: AuthEventMap[K]) => void): Unsubscribe;
+    emit<K extends AuthEventName>(event: K, payload: AuthEventMap[K]): void;
+}
+/** Creates an independent event bus. */
+export declare function createAuthEventBus(): AuthEventBus;
+/** The bus backing the free functions (`login`, `logout`, …) and the default client. */
+export declare const defaultAuthEventBus: AuthEventBus;
+/**
+ * Subscribes to an authentication event of the default client. Unlike the DOM `authenticated`
+ * CustomEvent, this channel is fully typed, works without a DOM (SSR, Node) and covers the whole
+ * auth lifecycle.
+ *
+ * @example
+ * ```typescript
+ * const off = onAuthEvent("unauthorized", ({ endpoint, error }) => {
+ *   // e.g. trigger a silent re-authentication
+ * });
+ * // later: off();
+ * ```
+ *
+ * @returns The unsubscribe function.
+ */
+export declare function onAuthEvent<K extends AuthEventName>(event: K, handler: (payload: AuthEventMap[K]) => void): Unsubscribe;
+/**
+ * Internal — notifies the subscribers of the default bus.
+ *
+ * @deprecated Internal helper kept for the free functions; context-aware code emits through
+ * `ctx.events` instead.
+ */
+export declare function emitAuthEvent<K extends AuthEventName>(event: K, payload: AuthEventMap[K]): void;
+//# sourceMappingURL=auth-events.d.ts.map

package/dist/authentication/events/auth-events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-events.d.ts","sourceRoot":"","sources":["../../../src/authentication/events/auth-events.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAC;AACvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AAEzF;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,aAAa,EAAE;QAAE,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC;IAC1C,YAAY,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,iBAAiB,CAAA;KAAE,CAAC;IAC7D,aAAa,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,QAAQ,CAAA;KAAE,CAAC;IACrE,cAAc,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC;AAE/C,8DAA8D;AAC9D,MAAM,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC;AAErC;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,CAAC,CAAC,SAAS,aAAa,EACxB,KAAK,EAAE,CAAC,EACR,OAAO,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,GAC1C,WAAW,CAAC;IACf,IAAI,CAAC,CAAC,SAAS,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;CACzE;AAED,wCAAwC;AACxC,wBAAgB,kBAAkB,IAAI,YAAY,CA8BjD;AAED,wFAAwF;AACxF,eAAO,MAAM,mBAAmB,cAAuB,CAAC;AAExD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,aAAa,EACjD,KAAK,EAAE,CAAC,EACR,OAAO,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,GAC1C,WAAW,CAEb;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,aAAa,EACnD,KAAK,EAAE,CAAC,EACR,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,GACvB,IAAI,CAEN"}

package/dist/authentication/events/emit-authenticated-event.d.ts

@@ -1,6 +1,15 @@
+import { type AtomicContext } from "../../client/atomic-context";
+/**
+ * Notifies the subscribers of a context that the authentication state changed, and mirrors it as a
+ * DOM `authenticated` CustomEvent.
+ */
+export declare function emitAuthenticatedEventWithContext(ctx: AtomicContext, authenticated: boolean): void;
 /**
  * Emits a custom 'authenticated' event with the provided authentication status.
  *
+ * The event is dispatched on `document` and bubbles up to `window`, so listeners attached on
+ * either target receive it.
+ *
  * @param authenticated - A boolean indicating whether the user is authenticated.
  *
  * @example

package/dist/authentication/events/emit-authenticated-event.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"emit-authenticated-event.d.ts","sourceRoot":"","sources":["../../../src/authentication/events/emit-authenticated-event.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,aAAa,EAAE,OAAO,QAa5D"}
+{"version":3,"file":"emit-authenticated-event.d.ts","sourceRoot":"","sources":["../../../src/authentication/events/emit-authenticated-event.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAEnB,MAAM,6BAA6B,CAAC;AAErC;;;GAGG;AACH,wBAAgB,iCAAiC,CAC/C,GAAG,EAAE,aAAa,EAClB,aAAa,EAAE,OAAO,QAqBvB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CAAC,aAAa,EAAE,OAAO,QAE5D"}

package/dist/authentication/events/index.d.ts

@@ -1,2 +1,3 @@
+export { type AuthEventMap, type AuthEventName, onAuthEvent, type Unsubscribe, } from "./auth-events";
 export { emitAuthenticatedEvent } from "./emit-authenticated-event";
 //# sourceMappingURL=index.d.ts.map

package/dist/authentication/events/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/authentication/events/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/authentication/events/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,WAAW,EACX,KAAK,WAAW,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC"}

package/dist/authentication/index.d.ts

@@ -1,5 +1,5 @@
-export { emitAuthenticatedEvent } from "./events";
+export { type AuthEventMap, type AuthEventName, emitAuthenticatedEvent, onAuthEvent, type Unsubscribe, } from "./events";
 export { tryOAuthAuthentication, trySAMLAuthentication } from "./providers";
-export { clearSessionTokens, detectAuthMode, isAuthenticated, login, logout, tryAutoAuthentication, } from "./session";
-export { deleteWebTokenCookie, getCsrfToken, getJWToken, getToken, setToken, } from "./tokens";
+export { clearSessionTokens, detectAuthMode, hasSession, isAuthenticated, isRedirectPending, login, logout, tryAutoAuthentication, } from "./session";
+export { deleteWebTokenCookie, getCsrfToken, getJWToken, getToken, requestWebTokenSession, setToken, } from "./tokens";
 //# sourceMappingURL=index.d.ts.map

package/dist/authentication/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authentication/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAGlD,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAE5E,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,KAAK,EACL,MAAM,EACN,qBAAqB,GACtB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,QAAQ,GACT,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authentication/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,sBAAsB,EACtB,WAAW,EACX,KAAK,WAAW,GACjB,MAAM,UAAU,CAAC;AAGlB,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAE5E,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,UAAU,EACV,eAAe,EACf,iBAAiB,EACjB,KAAK,EACL,MAAM,EACN,qBAAqB,GACtB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,sBAAsB,EACtB,QAAQ,GACT,MAAM,UAAU,CAAC"}

package/dist/authentication/providers/oauth-authentication.d.ts

@@ -1,8 +1,17 @@
+import { type AtomicContext } from "../../client/atomic-context";
+/** @see tryOAuthAuthentication */
+export declare const tryOAuthAuthenticationWithContext: (ctx: AtomicContext) => Promise<{
+    redirectUrl: string;
+}>;
 /**
  * Initiates the OAuth authentication process by sending a POST request to the backend.
  * The server responds with a redirect URL which is used to send the user to the OAuth provider's login page.
+ *
+ * The provider comes from `authMode: AuthMode.oauth(provider)` first, then the `autoOAuthProvider`
+ * configuration key.
+ *
  * @returns A promise that resolves to the server response containing the `redirectUrl`.
- * @throws An error if `autoOAuthProvider` is not configured in `globalConfig` or if the request fails.
+ * @throws An error if no OAuth provider is configured, or if the request fails.
  */
 export declare const tryOAuthAuthentication: () => Promise<{
     redirectUrl: string;

package/dist/authentication/providers/oauth-authentication.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-authentication.d.ts","sourceRoot":"","sources":["../../../src/authentication/providers/oauth-authentication.ts"],"names":[],"mappings":"AAWA;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB;iBAWI,MAAM;EAmD5C,CAAC"}
+{"version":3,"file":"oauth-authentication.d.ts","sourceRoot":"","sources":["../../../src/authentication/providers/oauth-authentication.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAEnB,MAAM,6BAA6B,CAAC;AAIrC,kCAAkC;AAClC,eAAO,MAAM,iCAAiC,GAC5C,KAAK,aAAa,KACjB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,CAUjC,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,QAAO,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,CACtB,CAAC"}

package/dist/authentication/providers/redirect-to-identity-provider.d.ts

@@ -0,0 +1,34 @@
+import { type AtomicContext } from "../../client/atomic-context";
+/** What differs between the OAuth and the SAML flows — everything else is shared. */
+declare const PROVIDER_KINDS: {
+    readonly oauth: {
+        readonly label: "OAuth";
+        readonly endpoint: "api/v1/security.oauth";
+        readonly action: "getcode";
+    };
+    readonly saml: {
+        readonly label: "SAML";
+        readonly endpoint: "api/v1/security.saml";
+        readonly action: "getresponse";
+    };
+};
+export interface IdentityProviderRedirectOptions {
+    kind: keyof typeof PROVIDER_KINDS;
+    /** Provider name as configured on the Sinequa server (autoOAuthProvider / autoSAMLProvider). */
+    provider: string;
+}
+/**
+ * Internal — shared body of `tryOAuthAuthentication` / `trySAMLAuthentication`.
+ *
+ * Asks the server for the identity provider's sign-in URL, then redirects the browser to it. A
+ * one-shot loop guard ({@link AUTH_REDIRECT_ATTEMPT_KEY}) prevents an endless redirect loop when
+ * the provider keeps sending the user back without a session. In a Node environment there is no
+ * browser to redirect: the server response is simply returned.
+ *
+ * @returns The server response containing the `redirectUrl`.
+ */
+export declare function redirectToIdentityProvider(ctx: AtomicContext, { kind, provider }: IdentityProviderRedirectOptions): Promise<{
+    redirectUrl: string;
+}>;
+export {};
+//# sourceMappingURL=redirect-to-identity-provider.d.ts.map

package/dist/authentication/providers/redirect-to-identity-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect-to-identity-provider.d.ts","sourceRoot":"","sources":["../../../src/authentication/providers/redirect-to-identity-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAInB,MAAM,6BAA6B,CAAC;AAQrC,qFAAqF;AACrF,QAAA,MAAM,cAAc;;;;;;;;;;;CAWV,CAAC;AAEX,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,MAAM,OAAO,cAAc,CAAC;IAClC,gGAAgG;IAChG,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;GASG;AACH,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,aAAa,EAClB,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,+BAA+B,GAClD,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAoDlC"}

package/dist/authentication/providers/saml-authentication.d.ts

@@ -1,8 +1,17 @@
+import { type AtomicContext } from "../../client/atomic-context";
+/** @see trySAMLAuthentication */
+export declare const trySAMLAuthenticationWithContext: (ctx: AtomicContext) => Promise<{
+    redirectUrl: string;
+}>;
 /**
  * Initiates the SAML authentication process by sending a POST request to the backend.
  * The server responds with a redirect URL which is used to send the user to the SAML identity provider's login page.
+ *
+ * The provider comes from `authMode: AuthMode.saml(provider)` first, then the `autoSAMLProvider`
+ * configuration key.
+ *
  * @returns A promise that resolves to the server response containing the `redirectUrl`.
- * @throws An error if `autoSAMLProvider` is not configured in `globalConfig` or if the request fails.
+ * @throws An error if no SAML provider is configured, or if the request fails.
  */
 export declare const trySAMLAuthentication: () => Promise<{
     redirectUrl: string;

package/dist/authentication/providers/saml-authentication.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"saml-authentication.d.ts","sourceRoot":"","sources":["../../../src/authentication/providers/saml-authentication.ts"],"names":[],"mappings":"AAWA;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB;iBAWK,MAAM;EAmD5C,CAAC"}
+{"version":3,"file":"saml-authentication.d.ts","sourceRoot":"","sources":["../../../src/authentication/providers/saml-authentication.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAEnB,MAAM,6BAA6B,CAAC;AAIrC,iCAAiC;AACjC,eAAO,MAAM,gCAAgC,GAC3C,KAAK,aAAa,KACjB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,CAUjC,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,QAAO,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,CACtB,CAAC"}

package/dist/authentication/session/auth-mode-marker.d.ts

@@ -1,3 +1,4 @@
+import { type AtomicContext } from "../../client/atomic-context";
 /**
  * Persisted record — in `localStorage`, shared across tabs/windows unlike `sessionStorage` — of
  * whether the last successful authentication on this browser used `credentials`.
@@ -8,7 +9,13 @@
  * resolve that ambiguity back to `credentials` instead of guessing `sso`. Cleared on logout so a
  * later, genuinely different SSO session isn't mislabeled.
  */
+export declare const rememberCredentialsAuthModeWithContext: (ctx: AtomicContext) => void;
+export declare const wasLastAuthModeCredentialsWithContext: (ctx: AtomicContext) => boolean;
+export declare const forgetAuthModeMarkerWithContext: (ctx: AtomicContext) => void;
+/** @see rememberCredentialsAuthModeWithContext */
 export declare const rememberCredentialsAuthMode: () => void;
+/** @see wasLastAuthModeCredentialsWithContext */
 export declare const wasLastAuthModeCredentials: () => boolean;
+/** @see forgetAuthModeMarkerWithContext */
 export declare const forgetAuthModeMarker: () => void;
 //# sourceMappingURL=auth-mode-marker.d.ts.map

package/dist/authentication/session/auth-mode-marker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-mode-marker.d.ts","sourceRoot":"","sources":["../../../src/authentication/session/auth-mode-marker.ts"],"names":[],"mappings":"AAQA;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,QAAO,IAE9C,CAAC;AAEF,eAAO,MAAM,0BAA0B,QAAO,OACa,CAAC;AAE5D,eAAO,MAAM,oBAAoB,QAAO,IAEvC,CAAC"}
+{"version":3,"file":"auth-mode-marker.d.ts","sourceRoot":"","sources":["../../../src/authentication/session/auth-mode-marker.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAInB,MAAM,6BAA6B,CAAC;AAQrC;;;;;;;;;GASG;AACH,eAAO,MAAM,sCAAsC,GACjD,KAAK,aAAa,KACjB,IAGF,CAAC;AAEF,eAAO,MAAM,qCAAqC,GAChD,KAAK,aAAa,KACjB,OAGF,CAAC;AAEF,eAAO,MAAM,+BAA+B,GAAI,KAAK,aAAa,KAAG,IAGpE,CAAC;AAEF,kDAAkD;AAClD,eAAO,MAAM,2BAA2B,QAAO,IACS,CAAC;AAEzD,iDAAiD;AACjD,eAAO,MAAM,0BAA0B,QAAO,OACS,CAAC;AAExD,2CAA2C;AAC3C,eAAO,MAAM,oBAAoB,QAAO,IACS,CAAC"}

package/dist/authentication/session/auth-state.d.ts

@@ -1,3 +1,4 @@
+import { type AtomicContext } from "../../client/atomic-context";
 /**
  * Persisted "authenticated" flag for token-less ambient SSO — IIS Integrated Windows Authentication
  * or proxy SSO, where the server authenticates every request via the connection/cookie and issues
@@ -8,7 +9,11 @@
  * by `clearSessionTokens()` (and therefore by `logout()`). `isAuthenticated()` reads it as a fallback
  * when no token is stored.
  */
+export declare const setAuthenticatedWithContext: (ctx: AtomicContext, authenticated: boolean) => void;
+/** Whether a token-less authenticated session was recorded (see {@link setAuthenticatedWithContext}). */
+export declare const isAuthenticatedFlagWithContext: (ctx: AtomicContext) => boolean;
+/** @see setAuthenticatedWithContext */
 export declare const setAuthenticated: (authenticated: boolean) => void;
-/** Whether a token-less authenticated session was recorded (see {@link setAuthenticated}). */
+/** @see isAuthenticatedFlagWithContext */
 export declare const isAuthenticatedFlag: () => boolean;
 //# sourceMappingURL=auth-state.d.ts.map

package/dist/authentication/session/auth-state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-state.d.ts","sourceRoot":"","sources":["../../../src/authentication/session/auth-state.ts"],"names":[],"mappings":"AAQA;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,GAAI,eAAe,OAAO,KAAG,IAMzD,CAAC;AAEF,8FAA8F;AAC9F,eAAO,MAAM,mBAAmB,QAAO,OACc,CAAC"}
+{"version":3,"file":"auth-state.d.ts","sourceRoot":"","sources":["../../../src/authentication/session/auth-state.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAInB,MAAM,6BAA6B,CAAC;AAGrC;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,GACtC,KAAK,aAAa,EAClB,eAAe,OAAO,KACrB,IAQF,CAAC;AAEF,yGAAyG;AACzG,eAAO,MAAM,8BAA8B,GAAI,KAAK,aAAa,KAAG,OAGtD,CAAC;AAEf,uCAAuC;AACvC,eAAO,MAAM,gBAAgB,GAAI,eAAe,OAAO,KAAG,IACE,CAAC;AAE7D,0CAA0C;AAC1C,eAAO,MAAM,mBAAmB,QAAO,OACS,CAAC"}

package/dist/authentication/session/detect-auth-mode.d.ts

@@ -4,7 +4,8 @@ import type { CCAppPreLogin } from "../../types";
  * Pure resolution of the authentication mode from the current configuration inputs and
  * the server pre-login response. No I/O, no `globalConfig` mutation, no `window` access.
  *
- * Precedence: explicit credentials preset > bearer token > OAuth provider > SAML provider > unknown.
+ * Precedence: any explicitly configured `authMode` other than `unknown` > bearer token > OAuth
+ * provider > SAML provider > unknown.
  * When both an OAuth and a SAML provider are present, OAuth wins (parity with the previous runtime,
  * which only used the SAML provider when no OAuth provider was configured).
  *

package/dist/authentication/session/detect-auth-mode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"detect-auth-mode.d.ts","sourceRoot":"","sources":["../../../src/authentication/session/detect-auth-mode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE;IACN,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,EACD,QAAQ,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,GAChC,QAAQ,CAgBV"}
+{"version":3,"file":"detect-auth-mode.d.ts","sourceRoot":"","sources":["../../../src/authentication/session/detect-auth-mode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE;IACN,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,EACD,QAAQ,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,GAChC,QAAQ,CAsBV"}

package/dist/authentication/session/has-session.d.ts

@@ -0,0 +1,26 @@
+import { type AtomicContext } from "../../client/atomic-context";
+/**
+ * Whether a session already exists for this context — **without ever redirecting**.
+ *
+ * A stored CSRF token answers immediately and offline. Failing that, the server is asked for one:
+ * `getCsrfToken` returns `200` with no token when there is no session, so a missing token is an
+ * expected answer rather than an error, and a genuine request failure (network / timeout / HTTP) is
+ * treated as "no session" — an outage must not be reported as a live session.
+ *
+ * This is the probe `login()` runs before any handshake, exposed on its own because `login()` is
+ * otherwise the only door and it **navigates away** for `oauth` and `saml`. An application that wants
+ * to know whether it is signed in — to decide between rendering a form and rendering the page, or to
+ * show two backends' states side by side — cannot afford a full-page redirect to find out.
+ *
+ * A successful probe stores the token it obtained (`getCsrfTokenWithContext` does), so the next
+ * request is authenticated, and clears the provider-redirect guard (see below). It deliberately does
+ * **not** emit `authenticated`: that event means "a sign-in completed", and `login()` remains the only
+ * thing that raises it. A probe that emitted it would make every listener believe a sign-in had just
+ * happened.
+ *
+ * @returns `true` when a session is available, `false` otherwise. Never throws.
+ */
+export declare function hasSessionWithContext(ctx: AtomicContext): Promise<boolean>;
+/** @see hasSessionWithContext */
+export declare const hasSession: () => Promise<boolean>;
+//# sourceMappingURL=has-session.d.ts.map

package/dist/authentication/session/has-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"has-session.d.ts","sourceRoot":"","sources":["../../../src/authentication/session/has-session.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAKnB,MAAM,6BAA6B,CAAC;AAKrC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,OAAO,CAAC,CAwBlB;AAsBD,iCAAiC;AACjC,eAAO,MAAM,UAAU,QAAO,OAAO,CAAC,OAAO,CACN,CAAC"}

package/dist/authentication/session/index.d.ts

@@ -1,6 +1,8 @@
 export { detectAuthMode } from "./detect-auth-mode";
+export { hasSession } from "./has-session";
 export { login } from "./login";
 export { clearSessionTokens, logout } from "./logout";
+export { isRedirectPending } from "./redirect-guard";
 export { tryAutoAuthentication } from "./try-auto-authentication";
 export { isAuthenticated } from "./user-authentication";
 //# sourceMappingURL=index.d.ts.map

package/dist/authentication/session/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/authentication/session/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/authentication/session/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/authentication/session/login.d.ts

@@ -1,21 +1,26 @@
+import { type AtomicContext } from "../../client/atomic-context";
 import type { Credentials } from "../../types";
 /**
- * Signs the user in.
+ * Signs the user in on the given context.
  *
  * When `credentials` are provided, authentication is performed with them directly. Otherwise:
- * - `credentials` mode → nothing automatic, the form must collect the credentials;
  * - `bearer` mode → authenticate with the configured bearer token;
- * - `oauth` / `saml` / `sso` / `unknown` → first check whether a session already exists (an existing
- *   token, or a successful CSRF retrieval — the latter also covers proxy/browser SSO). Only when no
- *   session exists do we run the mode-specific handshake: redirect to the provider (`oauth`/`saml`),
- *   or fall back to the credentials form (`sso`/`unknown`).
+ * - every other mode → first check whether a session already exists (an existing token, or a
+ *   successful CSRF retrieval). Only when no session exists do we run the mode-specific handshake:
+ *   redirect to the provider (`oauth`/`saml`), let the server authenticate the request
+ *   (`sso`/`unknown`, see {@link establishAmbientSession}), or leave it to the form (`credentials`).
  *
  * Checking the existing session BEFORE redirecting is essential: otherwise every bootstrap would
  * redirect to the OAuth/SAML provider again even though the user is already authenticated, causing a
- * redirect/reload loop.
+ * redirect/reload loop. The check also runs in `credentials` mode: nothing can be authenticated
+ * automatically there, but the caller still deserves the truth about an already-established session
+ * — reporting `false` while the user is signed in silently breaks `login().then(ok => ok && …)`
+ * callers (this is what made an impersonation switch a no-op in credentials mode).
  *
  * @param credentials - Optional username/password.
  * @returns A promise resolving to `true` when the user is authenticated.
  */
+export declare const loginWithContext: (ctx: AtomicContext, credentials?: Credentials) => Promise<boolean>;
+/** @see loginWithContext */
 export declare const login: (credentials?: Credentials) => Promise<boolean>;
 //# sourceMappingURL=login.d.ts.map

package/dist/authentication/session/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/authentication/session/login.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAyB/C;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,KAAK,GAAU,cAAc,WAAW,KAAG,OAAO,CAAC,OAAO,CA6GtE,CAAC"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/authentication/session/login.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAMnB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAgG/C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,gBAAgB,GAC3B,KAAK,aAAa,EAClB,cAAc,WAAW,KACxB,OAAO,CAAC,OAAO,CAuFjB,CAAC;AAEF,4BAA4B;AAC5B,eAAO,MAAM,KAAK,GAAI,cAAc,WAAW,KAAG,OAAO,CAAC,OAAO,CAClB,CAAC"}

package/dist/authentication/session/logout.d.ts

@@ -1,8 +1,19 @@
+import { type AtomicContext } from "../../client/atomic-context";
 /**
- * Logs out the user and delete the web Token Cookie.
- * @returns {Promise<string>} the logout redirectUrl
+ * Logs out the user of a context and deletes its web token cookie.
+ *
+ * @returns the logout `redirectUrl` returned by the server, or `undefined` when there is none to
+ * follow — either because an impersonation is active (the cookie is left untouched), because the
+ * server did not answer `ok`, or because the request failed (the failure is logged, not thrown).
+ * The local session is cleared in every case.
  */
+export declare function logoutWithContext(ctx: AtomicContext): Promise<string | undefined>;
+/** @see logoutWithContext */
 export declare function logout(): Promise<string | undefined>;
+/**
+ * Clears the local authentication state of a context and emits an `authenticated: false` event.
+ */
+export declare function clearSessionTokensWithContext(ctx: AtomicContext): void;
 /**
  * Clear the authentications tokens and emits authenticated event to false
  */

package/dist/authentication/session/logout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../../src/authentication/session/logout.ts"],"names":[],"mappings":"AAWA;;;GAGG;AACH,wBAAsB,MAAM,gCAsB3B;AAED;;GAEG;AACH,wBAAgB,kBAAkB,SAKjC"}
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../../src/authentication/session/logout.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAKnB,MAAM,6BAA6B,CAAC;AAOrC;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CA4B7B;AAED,6BAA6B;AAC7B,wBAAsB,MAAM,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAE1D;AAED;;GAEG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI,CAatE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC"}

package/dist/authentication/session/redirect-guard.d.ts

@@ -0,0 +1,18 @@
+import { type AtomicContext } from "../../client/atomic-context";
+/**
+ * Whether a provider redirect (oauth / saml) was started for this context and has not established a
+ * session yet.
+ *
+ * The flag is set right before the full-page navigation to the identity provider and cleared once a
+ * session is confirmed (or on `logout()`). It is the one-shot guard that turns a second failed
+ * attempt into a descriptive error instead of an endless redirect loop.
+ *
+ * Exposed because consumers need to read it and had no way to: the key was not exported, so
+ * `@sinequa/atomic-angular` mirrored the literal in its own source — and read it from
+ * `sessionStorage` **unprefixed**, which is correct only as long as no client sets a
+ * `storagePrefix`. Reading it through the context is what makes it right for two clients on one page.
+ */
+export declare function isRedirectPendingWithContext(ctx: AtomicContext): boolean;
+/** @see isRedirectPendingWithContext */
+export declare const isRedirectPending: () => boolean;
+//# sourceMappingURL=redirect-guard.d.ts.map

package/dist/authentication/session/redirect-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect-guard.d.ts","sourceRoot":"","sources":["../../../src/authentication/session/redirect-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAInB,MAAM,6BAA6B,CAAC;AAGrC;;;;;;;;;;;;GAYG;AACH,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAMxE;AAED,wCAAwC;AACxC,eAAO,MAAM,iBAAiB,QAAO,OACS,CAAC"}

package/dist/authentication/session/try-auto-authentication.d.ts

@@ -1,9 +1,10 @@
+import { type AtomicContext } from "../../client/atomic-context";
 /**
  * Probes the server for **auto-authentication** (e.g. OIDC) before falling back to the credentials
  * form.
  *
- * Unlike {@link getCsrfToken} — which calls the challenge endpoint with `suppressErrors=true` and
- * therefore never triggers the server-side auth challenge — and unlike {@link fetchPrincipal} — which
+ * Unlike `getCsrfToken` — which calls the challenge endpoint with `suppressErrors=true` and
+ * therefore never triggers the server-side auth challenge — and unlike `fetchPrincipal` — which
  * sends `noAutoAuthentication=true` to explicitly disable it — this probe hits a protected endpoint
  * **allowing the server to auto-authenticate**. When the user already has a valid IdP session, the
  * server completes the handshake and answers `200`; otherwise it answers `401` (or redirects to the
@@ -15,5 +16,7 @@
  * @returns `true` when the server auto-authenticated the user (`200`), `false` otherwise (401,
  *   redirect, timeout or any network error). Never throws.
  */
+export declare const tryAutoAuthenticationWithContext: (ctx: AtomicContext) => Promise<boolean>;
+/** @see tryAutoAuthenticationWithContext */
 export declare const tryAutoAuthentication: () => Promise<boolean>;
 //# sourceMappingURL=try-auto-authentication.d.ts.map

package/dist/authentication/session/try-auto-authentication.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"try-auto-authentication.d.ts","sourceRoot":"","sources":["../../../src/authentication/session/try-auto-authentication.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,qBAAqB,QAAa,OAAO,CAAC,OAAO,CAgB7D,CAAC"}
+{"version":3,"file":"try-auto-authentication.d.ts","sourceRoot":"","sources":["../../../src/authentication/session/try-auto-authentication.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAGnB,MAAM,6BAA6B,CAAC;AAQrC;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,gCAAgC,GAC3C,KAAK,aAAa,KACjB,OAAO,CAAC,OAAO,CAiCjB,CAAC;AAEF,4CAA4C;AAC5C,eAAO,MAAM,qBAAqB,QAAO,OAAO,CAAC,OAAO,CACN,CAAC"}