@sinequa/atomic 2.10.0 → 2.12.0

package/README.md

@@ -13,8 +13,6 @@
 Authentication, search, aggregations, datasets, preview — everything typed, tree-shakable, zero runtime dependencies.  
 SPFx-ready via the `@sinequa/atomic/spfx` subpath export.
 
-[Docs](./docs/index.mdx) · [Get started](./docs/start/index.mdx) · [Reference](./docs/reference/index.mdx)
-
 </div>
 
 ---
@@ -54,13 +52,27 @@ const result = await fetchQuery({
 });
 
 // One round-trip: the documents are in `records`, the facet counts in `aggregations`.
-// Check `$error` before concluding anything from an empty `records`.
-const { records, aggregations, $error } = result;
+const { records, aggregations } = result;
+```
+
+A failed request **throws** (`UnauthorizedError` on 401, `ServerError` on 500, `ApiError` otherwise): an
+empty `records` is a real "no match", never a swallowed failure. Wrap the call in `try/catch` to handle it.
+`Result.$error` is only declared by this library — it is set by `@sinequa/atomic-angular`'s `QueryService`
+(which catches the error and returns it), never by `fetchQuery`.
+
+```typescript
+try {
+  const result = await fetchQuery({ name: "<your-query>", text: "knowledge management" });
+  render(result.records);
+} catch (err) {
+  // ApiError | ServerError | UnauthorizedError | TimeoutError
+  showError(err);
+}
 ```
 
 `fetchAggregation(aggregation, query)` is for **paging** an aggregation you already received — it
 takes the `Aggregation` object off `result.aggregations` and the same query, as two positional
-arguments. See [Aggregations](./docs/search/aggregations.mdx).
+arguments.
 
 ---
 
@@ -91,7 +103,7 @@ Call `initializeAadHttpClient(null)` to detach the client (e.g. in `onDispose`).
 > and `AadHttpResponseLike`. `initializeAadHttpClient` registers the client globally for the free
 > functions; `createSpfxHttpAdapter(aadHttpClient)` is the same transport as an `httpAdapter` for
 > `createAtomicClient`. Standard (non-SPFx) consumers use `@sinequa/atomic` directly — no changes
-> needed. See [SPFx](./docs/integration/spfx.mdx).
+> needed.
 
 ---
 
@@ -117,29 +129,28 @@ const results = await client.http.post("api/v1/search.query", { text: "hello" })
 The free functions below keep working unchanged: they run on a default client whose configuration
 **is** `globalConfig`, and `getDefaultClient()` hands back that very instance — useful from code
 that cannot receive one (a distributed web component, a plugin).
-See [The client](./docs/core/client.mdx) and [Multiple backends](./docs/integration/multiple-backends.mdx).
 
 ### Authentication
 
 Full auth lifecycle — from first handshake to logout.
 
-| Export                                                 | Description                                                                                                                                                                  |
-| ------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `isAuthenticated()`                                    | Synchronous. `true` when a CSRF token is stored **or** a token-less session was recorded (ambient SSO issues no client token)                                                |
-| `hasSession()`                                         | Asks the server when nothing is stored, and never redirects — unlike `login()`                                                                                               |
-| `login(credentials?)`                                  | Login — switches on the resolved `authMode` (credentials / SSO / OAuth / SAML / bearer / unknown)                                                                            |
-| `logout()`                                             | Clears session, returns the server's `redirectUrl`                                                                                                                           |
-| `clearSessionTokens()`                                 | Drops the local session (tokens, token-less flag) and emits `authenticated: false`, without a server round-trip                                                              |
-| `detectAuthMode(config, preLogin?)`                    | Pure resolution of the `AuthMode` from config + server pre-login (no I/O)                                                                                                    |
-| `getToken()` / `setToken(token)`                       | Read/write the stored CSRF token                                                                                                                                             |
-| `requestWebTokenSession(credentials?)`                 | POSTs `security.webtoken`. The JWT lands in a cookie; the returned (and stored) value is the **CSRF token**. Omit the credentials to use the configured bearer token         |
-| `getCsrfToken()`                                       | CSRF token for mutating requests                                                                                                                                             |
-| `deleteWebTokenCookie()`                               | Explicitly removes the web token cookie                                                                                                                                      |
-| `onAuthEvent(event, handler)`                          | Typed subscription to the auth lifecycle (`authenticated`, `unauthorized`, `sessionLost`, `requestFailed`, `tokenRefreshed`, `loggedOut`) — returns the unsubscribe function |
-| `tryAutoAuthentication()`                              | Probes a protected endpoint for server-side auto-authentication (OIDC, IIS Negotiate) — used by `login()` in `sso`, `unknown` and `bearer` modes. Never throws               |
-| `isRedirectPending()`                                  | Whether an OAuth/SAML redirect is in flight and has not established a session yet                                                                                            |
-| `tryOAuthAuthentication()` / `trySAMLAuthentication()` | Redirect to the configured identity provider (with a one-shot redirect-loop guard)                                                                                           |
-| `emitAuthenticatedEvent(bool)`                         | Dispatches the DOM `'authenticated'` CustomEvent (on `document`, bubbles to `window`)                                                                                        |
+| Export                                                 | Description                                                                                                                                                                        |
+| ------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `isAuthenticated()`                                    | Synchronous. `true` when a CSRF token is stored **or** a token-less session was recorded (ambient SSO issues no client token)                                                      |
+| `hasSession()`                                         | Asks the server when nothing is stored, and never redirects — unlike `login()`                                                                                                     |
+| `login(credentials?)`                                  | Login — switches on the resolved `authMode` (credentials / SSO / OAuth / SAML / bearer / unknown)                                                                                  |
+| `logout()`                                             | Clears the local session and deletes the cookie; resolves to the server's `logoutUrl` (`Promise<string \| undefined>`), `undefined` if the deletion failed or during impersonation |
+| `clearSessionTokens()`                                 | Drops the local session (tokens, token-less flag) and emits `authenticated: false`, without a server round-trip                                                                    |
+| `detectAuthMode(config, preLogin?)`                    | Pure resolution of the `AuthMode` from config + server pre-login (no I/O)                                                                                                          |
+| `getToken()` / `setToken(token)`                       | Read/write the stored CSRF token                                                                                                                                                   |
+| `requestWebTokenSession(credentials?)`                 | POSTs `security.webtoken`. The JWT lands in a cookie; the returned (and stored) value is the **CSRF token**. Omit the credentials to use the configured bearer token               |
+| `getCsrfToken()`                                       | CSRF token for mutating requests                                                                                                                                                   |
+| `deleteWebTokenCookie()`                               | Explicitly removes the web token cookie                                                                                                                                            |
+| `onAuthEvent(event, handler)`                          | Typed subscription to the auth lifecycle (`authenticated`, `unauthorized`, `sessionLost`, `requestFailed`, `tokenRefreshed`, `loggedOut`) — returns the unsubscribe function       |
+| `tryAutoAuthentication()`                              | Probes a protected endpoint for server-side auto-authentication (OIDC, IIS Negotiate) — used by `login()` in `sso`, `unknown` and `bearer` modes. Never throws                     |
+| `isRedirectPending()`                                  | Whether an OAuth/SAML redirect is in flight and has not established a session yet                                                                                                  |
+| `tryOAuthAuthentication()` / `trySAMLAuthentication()` | Redirect to the configured identity provider (with a one-shot redirect-loop guard)                                                                                                 |
+| `emitAuthenticatedEvent(bool)`                         | Dispatches the DOM `'authenticated'` CustomEvent (on `document`, bubbles to `window`)                                                                                              |
 
 > `getJWToken` is **`@deprecated`**: it is an alias of `requestWebTokenSession`, renamed because the
 > old name suggested it returned the JWT. It will be removed in the next major.
@@ -147,8 +158,7 @@ Full auth lifecycle — from first handshake to logout.
 The authentication layer is configurable via `setGlobalConfig({ auth: { … } })` (`AuthOptions`):
 `timeoutMs`, `probeEndpoint`, injectable `storage`/`logger`/`fetch`, the requests' `credentials`
 mode, and `recoverFromUnauthorized` — the hook that re-establishes a session after a 401 and gets
-the request replayed once. See [Authentication](./docs/auth/index.mdx) and
-[Handling 401](./docs/auth/handling-401.mdx).
+the request replayed once.
 
 ```typescript
 import { isAuthenticated, login, logout } from "@sinequa/atomic";
@@ -162,7 +172,10 @@ if (!isAuthenticated()) {
   const okWithCredentials = await login({ username: "alice", password: "s3cr3t" });
 }
 
-const redirectUrl = await logout();
+// Resolves to the provider's `logoutUrl` (to navigate to), or `undefined` when there is none —
+// the cookie deletion failed (logged, not thrown) or impersonation is active (cookie left alone).
+const logoutUrl = await logout();
+if (logoutUrl) window.location.assign(logoutUrl);
 ```
 
 #### Auth mode (`AuthMode`) — **2.0**
@@ -189,7 +202,6 @@ const kind = globalConfig.authMode?.kind; // 'credentials' | 'sso' | 'oauth' | '
 > **`@deprecated` read-only getters** derived from `authMode`. Reading them still works, and writing
 > them through `setGlobalConfig({ useSSO: true })` is translated into the matching `authMode` — so
 > existing code keeps working. Prefer `authMode.kind` (and the `AuthMode.*` constructors) in new code.
-> Full upgrade notes: [Migrating from 1.x](./docs/reference/migrating-from-1x.mdx).
 
 ---
 
@@ -220,7 +232,7 @@ import {
 ```
 
 Auditing is not a `fetch*` function: use `Audit.notify(...)`, plus the record decorators
-`addAuditAdditionalInfo`, `addSessionId` and `addUrl`. See [Audit](./docs/integration/audit.mdx).
+`addAuditAdditionalInfo`, `addSessionId` and `addUrl`.
 
 ### Web API — v2
 
@@ -233,9 +245,6 @@ import {
 } from "@sinequa/atomic";
 ```
 
-The full endpoint list — with the `client.api` method and the free function for each — is in
-[Endpoints](./docs/reference/endpoints.mdx).
-
 ---
 
 ### Helpers
@@ -256,8 +265,6 @@ import {
 } from "@sinequa/atomic";
 ```
 
-More in [Helpers](./docs/reference/helpers.mdx).
-
 #### Filter builder
 
 Build structured `query.filters` without hand-writing filter objects. Combinators ignore falsy
@@ -281,7 +288,7 @@ Leaf operators: `eq` · `neq` · `gt` · `gte` · `lt` · `lte` · `like` · `co
 `filter.distribution(field, item.value)` handles the one case the leaf operators cannot: a
 **distribution** aggregation item (a date or size bucket), whose `value` is an expression the server
 built rather than a value. Passing it to `filter.eq` makes the backend answer
-`500 — "Field type error"`. See [Filters](./docs/search/filters.mdx).
+`500 — "Field type error"`.
 
 ---
 
@@ -299,9 +306,11 @@ import {
 } from "@sinequa/atomic";
 ```
 
-> The library's verbosity is set with `configureLogger({ level: LogLevel.DEBUG })`, **not** through
-> a configuration key. See [Logging](./docs/integration/logging.mdx) and
-> [URL state](./docs/search/url-state.mdx).
+> The library's verbosity is set with `configureLogger({ level: LogLevel.DEBUG })`. `LogLevel` is
+> `DEBUG` (0), `INFO` (1), `WARN` (2), `ERROR` (3), `NONE` (4); the default is `INFO`.
+> `setGlobalConfig({ logLevel })` applies it too (it forwards to `configureLogger({ level })`), but
+> `createAtomicClient({ logLevel })` and `client.configure({ logLevel })` do **not**: the logger is
+> process-wide, so a client scopes its logging through `auth.logger` instead.
 
 ---
 
@@ -336,8 +345,6 @@ import type {
 } from "@sinequa/atomic";
 ```
 
-Which type comes back from which call: [Type map](./docs/reference/types-map.mdx).
-
 ---
 
 ## Configuration
@@ -363,60 +370,154 @@ when they were not provided, then resolves the `authMode` from the server's pre-
 
 > `appInitializerFn` is a **`@deprecated`** alias of `initializeAppConfig` — use the latter.
 
-Three declared keys are read by nothing, and setting them has no effect: `logLevel` (set the level
-with `configureLogger({ level })`), `loginPath` (routing is yours — use `recoverFromUnauthorized` or
-the `unauthorized` event) and `createRoutes`. Every key, with its default:
-[Configuration keys](./docs/reference/config-keys.mdx).
+`logLevel` is applied by `setGlobalConfig({ logLevel })` only (see the logger note above: a client
+created with `createAtomicClient` ignores it). Two declared keys are inert in `@sinequa/atomic` and
+`@deprecated` there: `loginPath` (routing is yours — use `recoverFromUnauthorized` or the
+`unauthorized` event) and `createRoutes`. They are still **read by `@sinequa/atomic-angular`**, so
+leave them alone in an Angular application.
 
 ---
 
-## Testing
+## AI agent skill
 
-```bash
-npm test                    # vitest, watch mode
-npm test -- --watch=false   # single run (what CI does)
-```
-
-`--ui` is not available out of the box: `@vitest/ui` is an optional peer of vitest and is not
-installed here — `npm i -D @vitest/ui` first.
-
-Coverage is deepest on authentication (`AuthMode` detection, OAuth, SAML, credentials, tokens,
-401 recovery) and on the HTTP helpers. On the endpoints it is targeted rather than exhaustive —
-`fetchQuery`, `fetchAggregation`, `fetchPrincipal`, `searchPrincipals`, `fetchApp` and the
-agent-workspace workspaces. Also covered: the filter builder, metadata parsing, column resolution,
-pagination, date utilities and the SQL value helper.
-
-Injecting `fetch`, `storage` and `logger` through the configuration is what lets a test avoid module
-mocks — see [Testing](./docs/integration/testing.mdx).
-
----
-
-## Development
+An [agent skill](https://skills.sh) teaches coding agents (Claude Code, Cursor, Copilot...) how to use `@sinequa/atomic` correctly: setup, authentication, search, SPFx, common pitfalls. Install it from the public Sinequa Mint repository (`sinequa/sba-mint`):
 
 ```bash
-npm run build        # production build (vite + tsc)
-npm run watch        # rebuild on change
-npm run dev:pack     # build + pack locally
+npx skills add sinequa/sba-mint --skill atomic
 ```
 
----
+The skill is also versioned with the library in `skills/atomic` (internal GitLab: `npx skills add https://gitlab.chapsvision.in/sinequa/rnd/sba-atomic-js.git --skill atomic`).
 
-## Contributing
+---
 
-1. All tests must pass.
-2. Lint and format with Vite+ (Oxlint/Oxfmt) — `npx vp check --fix`
-3. Follow [Conventional Commits](https://www.conventionalcommits.org/).
-4. Any change touching `src/` needs a **changeset** in the same commit (`npm run changeset`, then
-   `npm run changeset:status` to check) — the `changeset-check` CI job blocks the merge without one.
-   Add `#skip-changeset` to the MR title for a change that does not touch the published library.
-   Full guide, with examples: [`CONTRIBUTING-changesets.md`](./CONTRIBUTING-changesets.md).
-5. New public API → add tests + JSDoc, and export it from `src/index.ts` (a helper that is written
-   and tested but not re-exported from the barrel is not part of the public API).
+## Releases
+
+What changed since **2.0.0**, newest first.
+
+### 2.11
+
+- `patchUserProfile()` now sends the **bare value** of the property as the PATCH body (`null` when it
+  is missing) instead of the whole profile, as the endpoint expects. Its signature is unchanged, but
+  it needs a backend that supports this: an older one answers `400`. `patch()` and
+  `patchWithContext()` are unaffected.
+- `patchUserProfile()` and `deleteUserProfileProperty()` throw before sending anything when
+  `userProfile.data.id` is missing, and percent-encode the user id, category and property name.
+
+### 2.10
+
+- **Masked dates** (`YYYY`, `YYYY-MM`) in date aggregations: `translateAggregationToDateOptions`
+  falls back to the item `value` when there is no `display`, and the filter now covers the real
+  period (`>= first day AND < first day of the next period`) instead of an `eq` on a partial date.
+  New `getDateMask` / `getMaskedDateBounds` helpers, and `Query.aggregation_overrides` to have the
+  engine aggregate a date column at a given granularity.
+- `parseValueAndOperatorFromItem` now reads all four comparison operators (`>` and `<=` were both
+  read as `lt`) and produces a readable label for distribution items without `display`.
+
+### 2.9 — Agent Workspace rename ⚠️
+
+The document-upload "containers" are now **workspaces**, following the backend. The old `container*`
+names are removed without aliases:
+
+- Functions: `listWorkspaces`, `getWorkspace`, `createWorkspace`, `updateWorkspace`,
+  `deleteWorkspaces`, `listWorkspaceDocuments`, `addWorkspaceDocuments`, `deleteWorkspaceDocuments`.
+- Client: `api.containers` → `api.workspaces`.
+- Payload fields: `containerId` → `workspaceId`, `containerIds` → `workspaceIds`, `containers[]` →
+  `workspaces[]`. Code still reading `res.containers` silently gets `undefined`.
+
+### 2.8
+
+- New **`sessionLost`** auth event (`client.auth.on("sessionLost", …)` / `onAuthEvent`): fires once
+  when a 401 could not be recovered, i.e. the session is really gone. Use it — rather than
+  `unauthorized`, which fires before any recovery — to show a "session expired" message.
+- A `recoverFromUnauthorized` hook that throws synchronously now counts as a refusal, like one that
+  rejects.
+
+### 2.7
+
+- `fetchUploadStatus()` to poll document-upload jobs, and `addWorkspaceDocuments()` (initially
+  `addContainerDocuments()`) to attach existing documents without a file transfer.
+- **Fix** `searchPrincipals()`, which returned nothing; new `fetchPrincipalsByIds()` to resolve
+  `domain|id` identities.
+- **Fix** workspace list / document list pagination.
+
+### 2.6
+
+- `flattenLegacyFilterValues()` flattens a legacy filter tree into its leaf values and displays, to
+  match an applied filter back against aggregation items or distribution buckets.
+
+### 2.5
+
+- `getOffsetFromDates()` / `getRelativeDate()` report the largest fitting unit (`year`, `month`,
+  `week`, `day`): "last year" instead of "400 days ago".
+- `DidYouMeanItem.appliedChanges`: per-term correction action reported by the engine (≥ 11.14).
+- More accurate types: `fetchQuery` / `fetchBulkQuery` return `Result & ResultPages`,
+  `QueryIntent.datasets` is no longer self-referential, `getIdFromUrl()` returns
+  `string | undefined`.
+- **Fixes**: `fetchSendPasswordResetEmail()` no longer throws outside a browser (new optional
+  `changePasswordRedirectUrl` argument — a positionally-passed context must move); the label mutations
+  are now audited; `fetchPreviewUrl()` actually returns the rendition; `resolveToColumnName()` no
+  longer throws on a configuration without the merged schema.
+
+### 2.4
+
+- `setGlobalConfig({ logLevel })` now applies the level. `loginPath` and `createRoutes` are
+  `@deprecated` (nothing reads them).
+- `toSqlValue()` is exported.
+- **Fixes**: requests with a body no longer throw on Node 18/20 (`navigator` missing);
+  `$hasMore` works on aggregations whose `count` is not 10 — declare real page sizes with the new
+  `aggregationCounts` key (`resolveAggregationCount()` / `aggregationHasMore()` helpers); the
+  two-argument `fetchAggregation()` now actually works and takes an optional `count`.
+- ⚠️ `sha512()` now **throws** without the Web Crypto API (plain-HTTP pages) instead of returning a
+  weak 32-bit hash. Use the new `hashString()` for cache keys and identifiers; serve over HTTPS for
+  real hashing.
+
+### 2.3 — Client, auth events, 401 recovery
+
+- **`createAtomicClient()` / `getDefaultClient()`** (experimental): isolated clients, each with its
+  own configuration, session and subscribers — several backends on one page, no module mocks in
+  tests. The whole API layer is context-aware and exposed as `client.api.*`. The free functions keep
+  working unchanged.
+- **Auth lifecycle**: `onAuthEvent()` (`authenticated`, `unauthorized`, `requestFailed`,
+  `tokenRefreshed`, `loggedOut`), `auth.recoverFromUnauthorized` (silent re-authentication, the
+  request is replayed once), `hasSession()` (redirect-free probe), `isRedirectPending()`,
+  `isExternalAuthMode()`, `requestWebTokenSession()` (replaces the misleadingly named
+  `getJWToken`, kept as a deprecated alias) and `AuthOptions` (timeout, storage, logger, fetch,
+  credentials mode).
+- `filter.distribution()` for date/size distribution buckets; `AggregateResult` for aggregate
+  responses; `uiLanguage` key (also drives the request `locale`); unified `RequestOptions` on every
+  HTTP helper, including `signal` and `noRecovery`.
+- **Fixes**: an explicit `authMode` is honoured (and `AuthMode.bearer(token)` actually sends its
+  token); `bearer` mode works with access tokens that forbid `webtoken`; `sso` mode can re-establish
+  a lost session; the OAuth/SAML redirect-loop guard really stops the loop; a 401 trailing behind a
+  `logout()` no longer signs the user back in; created clients use the SPFx `AadHttpClient`; clear
+  errors and complete HTTP error bodies.
+
+### 2.2
+
+- Document-upload container management endpoints (API v2) — renamed to workspaces in 2.9.
+- `searchPrincipals()` for search-as-you-type principal lookup.
+
+### 2.0.1 – 2.1.0
+
+- **2.1** — `del()` accepts a JSON body; any 2xx status is now treated as success; `put()` sends the
+  right `Content-Type`; the JWT request no longer sets explicit headers; a user-profile property
+  deletion failure now surfaces an error.
+- **2.0.8** — A credentials session is no longer mistaken for SSO.
+- **2.0.6** — `legacyFilterToFilter()` converts legacy filters to the new `Filter` format.
+- **2.0.5** — Token-less **Windows/IIS SSO** support.
+- **2.0.4** — **SPFx support** through the `@sinequa/atomic/spfx` subpath export.
+- **2.0.3** — OIDC server-side auto-authentication is trusted; CSRF refresh is best-effort and
+  `getCsrfToken()` returns `null` on a token-less 200 instead of throwing; the static index fetch
+  honours `basePath`.
+- **2.0.2** — OIDC server-side auto-authentication in the `unknown` login branch; new `important`
+  option on notification events.
+- **2.0.1** — OAuth/SAML redirect loop is broken when the provider never authenticates; `userOverride`
+  typo fixed in credentials login.
 
 ---
 
 <div align="center">
 
-Built for the [Sinequa](https://www.sinequa.com/) ecosystem · [Report an issue](https://gitlab.chapsvision.in/sinequa/rnd/sba-atomic-js/-/issues)
+Built for the [Sinequa](https://www.sinequa.com/) ecosystem
 
 </div>

package/dist/atomic.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./src-CPlI3qi5.cjs");exports.API=e._t,exports.ApiError=e.qn,exports.Audit=e.At,exports.AuditEventType=e.in,exports.AuthMode=e.ir,exports.DEFAULT_AGGREGATION_COUNT=e.on,exports.DidYouMeanKind=e.en,exports.EngineType=e.rn,exports.EngineTypeModifier=e.nn,exports.LogLevel=e.ur,exports.MINIMUM_COMPATIBLE_SERVER_API_VERSION=e.tn,exports.RFMDisplay=e.$t,exports.ServerError=e.Wn,exports.TimeoutError=e.Ln,exports.UnauthorizedError=e.Kn,exports.addAuditAdditionalInfo=e.jt,exports.addConcepts=e.b,exports.addSessionId=e.Mt,exports.addUrl=e.Nt,exports.addWorkspaceDocuments=e.W,exports.aggItemRegex=e.D,exports.aggregationHasMore=e.sn,exports.aggregationItemStrictCompare=e.O,exports.appInitializerFn=e.ln,exports.applyConfig=e.tr,exports.assertNever=e.On,exports.bisect=e.E,exports.buildPathsAndLevels=e.mt,exports.clearSessionTokens=e.xn,exports.configureLogger=e.dr,exports.createAtomicClient=e.F,exports.createHeaders=e.Jn,exports.createHeadersWithContext=e.Yn,exports.createTimeoutController=e.In,exports.createUserProfile=e.R,exports.createWorkspace=e.G,Object.defineProperty(exports,"debug",{enumerable:!0,get:function(){return e.fr}}),exports.del=e._n,exports.delWithContext=e.vn,exports.deleteUserProfileProperty=e.z,exports.deleteUserSettings=e.$,exports.deleteWebTokenCookie=e.Cn,exports.deleteWorkspaceDocuments=e.K,exports.deleteWorkspaces=e.q,exports.detectAuthMode=e.Nn,exports.emitAuthenticatedEvent=e.Zn,Object.defineProperty(exports,"error",{enumerable:!0,get:function(){return e.pr}}),exports.escapeExpr=e.Pt,exports.expiresSoon=e.n,exports.extraColumns=e.Zt,exports.fetchAggregation=e.kt,exports.fetchApp=e.un,exports.fetchAppPreLogin=e.dn,exports.fetchBulkQuery=e.ht,exports.fetchChangePassword=e.Q,exports.fetchDataset=e.Et,exports.fetchDatasetList=e.Dt,exports.fetchDatasets=e.Ot,exports.fetchLabels=e.wt,exports.fetchPreview=e.St,exports.fetchPreviewUrl=e.Ct,exports.fetchPrincipal=e.vt,exports.fetchPrincipalList=e.yt,exports.fetchPrincipalUserid=e.bt,exports.fetchPrincipalUserids=e.xt,exports.fetchPrincipalsByIds=e.ut,exports.fetchQuery=e.gt,exports.fetchQueryExport=e.pt,exports.fetchQueryIntent=e.ft,exports.fetchSendPasswordResetEmail=e.H,exports.fetchSimilarDocuments=e.lt,exports.fetchSponsoredLinks=e.ct,exports.fetchSuggest=e.it,exports.fetchSuggestField=e.at,exports.fetchSuggestQuery=e.ot,exports.fetchTextChunks=e.rt,exports.fetchUploadStatus=e.U,exports.fetchUserProfile=e.B,exports.fetchUserSettings=e.et,exports.fetchVersion=e.L,exports.filter=e.Jt,exports.flattenLegacyFilterValues=e.Yt,exports.get=e.jn,exports.getConcepts=e.x,exports.getCsrfToken=e.An,exports.getDateMask=e.k,exports.getDefaultClient=e.I,exports.getFiltersFromURI=e.s,exports.getFiltersFromUrl=e.c,exports.getHelpIndexUrl=e.a,exports.getIdFromUrl=e.l,exports.getJWToken=e.En,exports.getMaskedDateBounds=e.A,exports.getMetadata=e.Kt,exports.getMetadataWithValues=e.qt,exports.getOffsetFromDates=e.v,exports.getQueryPageFromUrl=e.u,exports.getQueryParamsFromUrl=e.d,exports.getQueryTabFromUrl=e.f,exports.getQueryTextFromUrl=e.p,exports.getRelativeDate=e.y,exports.getTime=e.Ft,exports.getToken=e.Xn,exports.getUrlParamsFromQueryParams=e.m,exports.getWithContext=e.Mn,exports.getWorkspace=e.J,exports.globalConfig=e.nr,exports.guid=e.It,exports.handleResponse=e.Hn,exports.handleResponseWithContext=e.Un,exports.hasSession=e.kn,exports.hashString=e.Lt,Object.defineProperty(exports,"info",{enumerable:!0,get:function(){return e.mr}}),exports.initializeAppConfig=e.fn,exports.isArrayBuffer=e.Rt,exports.isAuthenticated=e.yn,exports.isBlob=e.zt,exports.isDate=e.Bt,exports.isExpired=e.r,exports.isExternalAuthMode=e.ar,exports.isJsonable=e.Vt,exports.isNotInputEvent=e._,exports.isObject=e.Ht,exports.isRedirectPending=e.bn,exports.isString=e.Ut,exports.labels=e.Tt,exports.legacyBooleansToAuthMode=e.or,exports.legacyFilterToFilter=e.Xt,exports.listWorkspaceDocuments=e.Y,exports.listWorkspaces=e.X,exports.login=e.wn,exports.logout=e.Sn,exports.makeColumn=e.Qt,exports.notify=e.g,exports.onAuthEvent=e.gr,exports.openParentNodes=e.j,exports.parseText=e.S,exports.parseValueAndOperatorFromItem=e.M,exports.patch=e.hn,exports.patchUserProfile=e.V,exports.patchUserSettings=e.tt,exports.patchWithContext=e.gn,exports.post=e.Rn,exports.postWithContext=e.zn,exports.put=e.pn,exports.putWithContext=e.mn,exports.queryParamsFromUrl=e.h,exports.removeConcept=e.C,exports.removeConcepts=e.w,exports.requestWebTokenSession=e.Dn,exports.resolveAggregationCount=e.cn,exports.resolveBearerToken=e.sr,exports.resolveNoAutoAuthentication=e.Bn,exports.resolveNoAutoAuthenticationWithContext=e.Vn,exports.resolveOAuthProvider=e.cr,exports.resolveSAMLProvider=e.lr,exports.resolveToColumnName=e.an,exports.resultPages=e.Gt,exports.rewriteText=e.T,exports.saveUserSettings=e.nt,exports.searchPrincipals=e.dt,exports.setGlobalConfig=e.rr,exports.setToken=e.Gn,exports.sha512=e.Wt,exports.suggestionsToTreeAggregationNodes=e.N,exports.sysLang=e.o,exports.toDate=e.i,exports.toSqlValue=e.st,exports.translateAggregationToDateOptions=e.P,exports.tryAutoAuthentication=e.Tn,exports.tryOAuthAuthentication=e.Fn,exports.trySAMLAuthentication=e.Pn,exports.updateWorkspace=e.Z,Object.defineProperty(exports,"warn",{enumerable:!0,get:function(){return e.hr}}),exports.withRetry=e.t;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./src-CCjB0b1J.cjs");exports.API=e.vt,exports.ApiError=e.Jn,exports.Audit=e.jt,exports.AuditEventType=e.an,exports.AuthMode=e.ar,exports.DEFAULT_AGGREGATION_COUNT=e.sn,exports.DidYouMeanKind=e.tn,exports.EngineType=e.in,exports.EngineTypeModifier=e.rn,exports.LogLevel=e.dr,exports.MINIMUM_COMPATIBLE_SERVER_API_VERSION=e.nn,exports.RFMDisplay=e.en,exports.ServerError=e.Gn,exports.TimeoutError=e.Rn,exports.UnauthorizedError=e.qn,exports.addAuditAdditionalInfo=e.Mt,exports.addConcepts=e.b,exports.addSessionId=e.Nt,exports.addUrl=e.Pt,exports.addWorkspaceDocuments=e.G,exports.aggItemRegex=e.D,exports.aggregationHasMore=e.cn,exports.aggregationItemStrictCompare=e.O,exports.appInitializerFn=e.un,exports.applyConfig=e.nr,exports.assertNever=e.kn,exports.bisect=e.E,exports.buildPathsAndLevels=e.ht,exports.clearSessionTokens=e.Sn,exports.configureLogger=e.fr,exports.createAtomicClient=e.F,exports.createHeaders=e.Yn,exports.createHeadersWithContext=e.Xn,exports.createTimeoutController=e.Ln,exports.createUserProfile=e.R,exports.createWorkspace=e.K,Object.defineProperty(exports,"debug",{enumerable:!0,get:function(){return e.pr}}),exports.del=e.vn,exports.delWithContext=e.yn,exports.deleteUserProfileProperty=e.z,exports.deleteUserSettings=e.et,exports.deleteWebTokenCookie=e.wn,exports.deleteWorkspaceDocuments=e.q,exports.deleteWorkspaces=e.J,exports.detectAuthMode=e.Pn,exports.emitAuthenticatedEvent=e.Qn,Object.defineProperty(exports,"error",{enumerable:!0,get:function(){return e.mr}}),exports.escapeExpr=e.Ft,exports.expiresSoon=e.n,exports.extraColumns=e.Qt,exports.fetchAggregation=e.At,exports.fetchApp=e.dn,exports.fetchAppPreLogin=e.fn,exports.fetchBulkQuery=e.gt,exports.fetchChangePassword=e.$,exports.fetchDataset=e.Dt,exports.fetchDatasetList=e.Ot,exports.fetchDatasets=e.kt,exports.fetchLabels=e.Tt,exports.fetchPreview=e.Ct,exports.fetchPreviewUrl=e.wt,exports.fetchPrincipal=e.yt,exports.fetchPrincipalList=e.bt,exports.fetchPrincipalUserid=e.xt,exports.fetchPrincipalUserids=e.St,exports.fetchPrincipalsByIds=e.dt,exports.fetchQuery=e._t,exports.fetchQueryExport=e.mt,exports.fetchQueryIntent=e.pt,exports.fetchSendPasswordResetEmail=e.U,exports.fetchSimilarDocuments=e.ut,exports.fetchSponsoredLinks=e.lt,exports.fetchSuggest=e.at,exports.fetchSuggestField=e.ot,exports.fetchSuggestQuery=e.st,exports.fetchTextChunks=e.it,exports.fetchUploadStatus=e.W,exports.fetchUserProfile=e.B,exports.fetchUserProfileCustomData=e.V,exports.fetchUserSettings=e.tt,exports.fetchVersion=e.L,exports.filter=e.Yt,exports.flattenLegacyFilterValues=e.Xt,exports.get=e.Mn,exports.getConcepts=e.x,exports.getCsrfToken=e.jn,exports.getDateMask=e.k,exports.getDefaultClient=e.I,exports.getFiltersFromURI=e.s,exports.getFiltersFromUrl=e.c,exports.getHelpIndexUrl=e.a,exports.getIdFromUrl=e.l,exports.getJWToken=e.Dn,exports.getMaskedDateBounds=e.A,exports.getMetadata=e.qt,exports.getMetadataWithValues=e.Jt,exports.getOffsetFromDates=e.v,exports.getQueryPageFromUrl=e.u,exports.getQueryParamsFromUrl=e.d,exports.getQueryTabFromUrl=e.f,exports.getQueryTextFromUrl=e.p,exports.getRelativeDate=e.y,exports.getTime=e.It,exports.getToken=e.Zn,exports.getUrlParamsFromQueryParams=e.m,exports.getWithContext=e.Nn,exports.getWorkspace=e.Y,exports.globalConfig=e.rr,exports.guid=e.Lt,exports.handleResponse=e.Un,exports.handleResponseWithContext=e.Wn,exports.hasSession=e.An,exports.hashString=e.Rt,Object.defineProperty(exports,"info",{enumerable:!0,get:function(){return e.hr}}),exports.initializeAppConfig=e.pn,exports.isArrayBuffer=e.zt,exports.isAuthenticated=e.bn,exports.isBlob=e.Bt,exports.isDate=e.Vt,exports.isExpired=e.r,exports.isExternalAuthMode=e.or,exports.isJsonable=e.Ht,exports.isNotInputEvent=e._,exports.isObject=e.Ut,exports.isRedirectPending=e.xn,exports.isString=e.Wt,exports.labels=e.Et,exports.legacyBooleansToAuthMode=e.sr,exports.legacyFilterToFilter=e.Zt,exports.listWorkspaceDocuments=e.X,exports.listWorkspaces=e.Z,exports.login=e.Tn,exports.logout=e.Cn,exports.makeColumn=e.$t,exports.notify=e.g,exports.onAuthEvent=e._r,exports.openParentNodes=e.j,exports.parseText=e.S,exports.parseValueAndOperatorFromItem=e.M,exports.patch=e.gn,exports.patchUserProfile=e.H,exports.patchUserSettings=e.nt,exports.patchWithContext=e._n,exports.post=e.zn,exports.postWithContext=e.Bn,exports.put=e.mn,exports.putWithContext=e.hn,exports.queryParamsFromUrl=e.h,exports.removeConcept=e.C,exports.removeConcepts=e.w,exports.requestWebTokenSession=e.On,exports.resolveAggregationCount=e.ln,exports.resolveBearerToken=e.cr,exports.resolveNoAutoAuthentication=e.Vn,exports.resolveNoAutoAuthenticationWithContext=e.Hn,exports.resolveOAuthProvider=e.lr,exports.resolveSAMLProvider=e.ur,exports.resolveToColumnName=e.on,exports.resultPages=e.Kt,exports.rewriteText=e.T,exports.saveUserSettings=e.rt,exports.searchPrincipals=e.ft,exports.setGlobalConfig=e.ir,exports.setToken=e.Kn,exports.sha512=e.Gt,exports.suggestionsToTreeAggregationNodes=e.N,exports.sysLang=e.o,exports.toDate=e.i,exports.toSqlValue=e.ct,exports.translateAggregationToDateOptions=e.P,exports.tryAutoAuthentication=e.En,exports.tryOAuthAuthentication=e.In,exports.trySAMLAuthentication=e.Fn,exports.updateWorkspace=e.Q,Object.defineProperty(exports,"warn",{enumerable:!0,get:function(){return e.gr}}),exports.withRetry=e.t;

package/dist/atomic.js

@@ -1 +1 @@
-export { _t as API, qn as ApiError, At as Audit, in as AuditEventType, ir as AuthMode, on as DEFAULT_AGGREGATION_COUNT, en as DidYouMeanKind, rn as EngineType, nn as EngineTypeModifier, ur as LogLevel, tn as MINIMUM_COMPATIBLE_SERVER_API_VERSION, $t as RFMDisplay, Wn as ServerError, Ln as TimeoutError, Kn as UnauthorizedError, jt as addAuditAdditionalInfo, b as addConcepts, Mt as addSessionId, Nt as addUrl, W as addWorkspaceDocuments, D as aggItemRegex, sn as aggregationHasMore, O as aggregationItemStrictCompare, ln as appInitializerFn, tr as applyConfig, On as assertNever, E as bisect, mt as buildPathsAndLevels, xn as clearSessionTokens, dr as configureLogger, F as createAtomicClient, Jn as createHeaders, Yn as createHeadersWithContext, In as createTimeoutController, R as createUserProfile, G as createWorkspace, fr as debug, _n as del, vn as delWithContext, z as deleteUserProfileProperty, $ as deleteUserSettings, Cn as deleteWebTokenCookie, K as deleteWorkspaceDocuments, q as deleteWorkspaces, Nn as detectAuthMode, Zn as emitAuthenticatedEvent, pr as error, Pt as escapeExpr, n as expiresSoon, Zt as extraColumns, kt as fetchAggregation, un as fetchApp, dn as fetchAppPreLogin, ht as fetchBulkQuery, Q as fetchChangePassword, Et as fetchDataset, Dt as fetchDatasetList, Ot as fetchDatasets, wt as fetchLabels, St as fetchPreview, Ct as fetchPreviewUrl, vt as fetchPrincipal, yt as fetchPrincipalList, bt as fetchPrincipalUserid, xt as fetchPrincipalUserids, ut as fetchPrincipalsByIds, gt as fetchQuery, pt as fetchQueryExport, ft as fetchQueryIntent, H as fetchSendPasswordResetEmail, lt as fetchSimilarDocuments, ct as fetchSponsoredLinks, it as fetchSuggest, at as fetchSuggestField, ot as fetchSuggestQuery, rt as fetchTextChunks, U as fetchUploadStatus, B as fetchUserProfile, et as fetchUserSettings, L as fetchVersion, Jt as filter, Yt as flattenLegacyFilterValues, jn as get, x as getConcepts, An as getCsrfToken, k as getDateMask, I as getDefaultClient, s as getFiltersFromURI, c as getFiltersFromUrl, a as getHelpIndexUrl, l as getIdFromUrl, En as getJWToken, A as getMaskedDateBounds, Kt as getMetadata, qt as getMetadataWithValues, v as getOffsetFromDates, u as getQueryPageFromUrl, d as getQueryParamsFromUrl, f as getQueryTabFromUrl, p as getQueryTextFromUrl, y as getRelativeDate, Ft as getTime, Xn as getToken, m as getUrlParamsFromQueryParams, Mn as getWithContext, J as getWorkspace, nr as globalConfig, It as guid, Hn as handleResponse, Un as handleResponseWithContext, kn as hasSession, Lt as hashString, mr as info, fn as initializeAppConfig, Rt as isArrayBuffer, yn as isAuthenticated, zt as isBlob, Bt as isDate, r as isExpired, ar as isExternalAuthMode, Vt as isJsonable, _ as isNotInputEvent, Ht as isObject, bn as isRedirectPending, Ut as isString, Tt as labels, or as legacyBooleansToAuthMode, Xt as legacyFilterToFilter, Y as listWorkspaceDocuments, X as listWorkspaces, wn as login, Sn as logout, Qt as makeColumn, g as notify, gr as onAuthEvent, j as openParentNodes, S as parseText, M as parseValueAndOperatorFromItem, hn as patch, V as patchUserProfile, tt as patchUserSettings, gn as patchWithContext, Rn as post, zn as postWithContext, pn as put, mn as putWithContext, h as queryParamsFromUrl, C as removeConcept, w as removeConcepts, Dn as requestWebTokenSession, cn as resolveAggregationCount, sr as resolveBearerToken, Bn as resolveNoAutoAuthentication, Vn as resolveNoAutoAuthenticationWithContext, cr as resolveOAuthProvider, lr as resolveSAMLProvider, an as resolveToColumnName, Gt as resultPages, T as rewriteText, nt as saveUserSettings, dt as searchPrincipals, rr as setGlobalConfig, Gn as setToken, Wt as sha512, N as suggestionsToTreeAggregationNodes, o as sysLang, i as toDate, st as toSqlValue, P as translateAggregationToDateOptions, Tn as tryAutoAuthentication, Fn as tryOAuthAuthentication, Pn as trySAMLAuthentication, Z as updateWorkspace, hr as warn, t as withRetry } from "./src-s3KlD6YE.js";
+export { vt as API, Jn as ApiError, jt as Audit, an as AuditEventType, ar as AuthMode, sn as DEFAULT_AGGREGATION_COUNT, tn as DidYouMeanKind, in as EngineType, rn as EngineTypeModifier, dr as LogLevel, nn as MINIMUM_COMPATIBLE_SERVER_API_VERSION, en as RFMDisplay, Gn as ServerError, Rn as TimeoutError, qn as UnauthorizedError, Mt as addAuditAdditionalInfo, b as addConcepts, Nt as addSessionId, Pt as addUrl, G as addWorkspaceDocuments, D as aggItemRegex, cn as aggregationHasMore, O as aggregationItemStrictCompare, un as appInitializerFn, nr as applyConfig, kn as assertNever, E as bisect, ht as buildPathsAndLevels, Sn as clearSessionTokens, fr as configureLogger, F as createAtomicClient, Yn as createHeaders, Xn as createHeadersWithContext, Ln as createTimeoutController, R as createUserProfile, K as createWorkspace, pr as debug, vn as del, yn as delWithContext, z as deleteUserProfileProperty, et as deleteUserSettings, wn as deleteWebTokenCookie, q as deleteWorkspaceDocuments, J as deleteWorkspaces, Pn as detectAuthMode, Qn as emitAuthenticatedEvent, mr as error, Ft as escapeExpr, n as expiresSoon, Qt as extraColumns, At as fetchAggregation, dn as fetchApp, fn as fetchAppPreLogin, gt as fetchBulkQuery, $ as fetchChangePassword, Dt as fetchDataset, Ot as fetchDatasetList, kt as fetchDatasets, Tt as fetchLabels, Ct as fetchPreview, wt as fetchPreviewUrl, yt as fetchPrincipal, bt as fetchPrincipalList, xt as fetchPrincipalUserid, St as fetchPrincipalUserids, dt as fetchPrincipalsByIds, _t as fetchQuery, mt as fetchQueryExport, pt as fetchQueryIntent, U as fetchSendPasswordResetEmail, ut as fetchSimilarDocuments, lt as fetchSponsoredLinks, at as fetchSuggest, ot as fetchSuggestField, st as fetchSuggestQuery, it as fetchTextChunks, W as fetchUploadStatus, B as fetchUserProfile, V as fetchUserProfileCustomData, tt as fetchUserSettings, L as fetchVersion, Yt as filter, Xt as flattenLegacyFilterValues, Mn as get, x as getConcepts, jn as getCsrfToken, k as getDateMask, I as getDefaultClient, s as getFiltersFromURI, c as getFiltersFromUrl, a as getHelpIndexUrl, l as getIdFromUrl, Dn as getJWToken, A as getMaskedDateBounds, qt as getMetadata, Jt as getMetadataWithValues, v as getOffsetFromDates, u as getQueryPageFromUrl, d as getQueryParamsFromUrl, f as getQueryTabFromUrl, p as getQueryTextFromUrl, y as getRelativeDate, It as getTime, Zn as getToken, m as getUrlParamsFromQueryParams, Nn as getWithContext, Y as getWorkspace, rr as globalConfig, Lt as guid, Un as handleResponse, Wn as handleResponseWithContext, An as hasSession, Rt as hashString, hr as info, pn as initializeAppConfig, zt as isArrayBuffer, bn as isAuthenticated, Bt as isBlob, Vt as isDate, r as isExpired, or as isExternalAuthMode, Ht as isJsonable, _ as isNotInputEvent, Ut as isObject, xn as isRedirectPending, Wt as isString, Et as labels, sr as legacyBooleansToAuthMode, Zt as legacyFilterToFilter, X as listWorkspaceDocuments, Z as listWorkspaces, Tn as login, Cn as logout, $t as makeColumn, g as notify, _r as onAuthEvent, j as openParentNodes, S as parseText, M as parseValueAndOperatorFromItem, gn as patch, H as patchUserProfile, nt as patchUserSettings, _n as patchWithContext, zn as post, Bn as postWithContext, mn as put, hn as putWithContext, h as queryParamsFromUrl, C as removeConcept, w as removeConcepts, On as requestWebTokenSession, ln as resolveAggregationCount, cr as resolveBearerToken, Vn as resolveNoAutoAuthentication, Hn as resolveNoAutoAuthenticationWithContext, lr as resolveOAuthProvider, ur as resolveSAMLProvider, on as resolveToColumnName, Kt as resultPages, T as rewriteText, rt as saveUserSettings, ft as searchPrincipals, ir as setGlobalConfig, Kn as setToken, Gt as sha512, N as suggestionsToTreeAggregationNodes, o as sysLang, i as toDate, ct as toSqlValue, P as translateAggregationToDateOptions, En as tryAutoAuthentication, In as tryOAuthAuthentication, Fn as trySAMLAuthentication, Q as updateWorkspace, gr as warn, t as withRetry } from "./src-CK3j-Qz_.js";

package/dist/authentication/constants.d.ts

@@ -1,4 +1,4 @@
-import { type AtomicContext } from "../client/atomic-context";
+import { type AtomicContext } from "../client/atomic-context.js";
 /**
  * Default timeout in milliseconds for all authentication network requests.
  * Override it per application via `setGlobalConfig({ auth: { timeoutMs } })`.

package/dist/authentication/events/auth-events.d.ts

@@ -1,5 +1,5 @@
-import type { ApiError } from "../../web-api/helpers/errors/api-error";
-import type { UnauthorizedError } from "../../web-api/helpers/errors/unauthorized-error";
+import type { ApiError } from "../../web-api/helpers/errors/api-error.js";
+import type { UnauthorizedError } from "../../web-api/helpers/errors/unauthorized-error.js";
 /**
  * Why a 401 was left to reach its caller (payload of the `sessionLost` event):
  *

package/dist/authentication/events/emit-authenticated-event.d.ts

@@ -1,4 +1,4 @@
-import { type AtomicContext } from "../../client/atomic-context";
+import { type AtomicContext } from "../../client/atomic-context.js";
 /**
  * Notifies the subscribers of a context that the authentication state changed, and mirrors it as a
  * DOM `authenticated` CustomEvent.

package/dist/authentication/events/index.d.ts

@@ -1,3 +1,3 @@
-export { type AuthEventMap, type AuthEventName, onAuthEvent, type SessionLostReason, type Unsubscribe, } from "./auth-events";
-export { emitAuthenticatedEvent } from "./emit-authenticated-event";
+export { type AuthEventMap, type AuthEventName, onAuthEvent, type SessionLostReason, type Unsubscribe, } from "./auth-events.js";
+export { emitAuthenticatedEvent } from "./emit-authenticated-event.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/authentication/index.d.ts

@@ -1,5 +1,5 @@
-export { type AuthEventMap, type AuthEventName, emitAuthenticatedEvent, onAuthEvent, type SessionLostReason, type Unsubscribe, } from "./events";
-export { tryOAuthAuthentication, trySAMLAuthentication } from "./providers";
-export { clearSessionTokens, detectAuthMode, hasSession, isAuthenticated, isRedirectPending, login, logout, tryAutoAuthentication, } from "./session";
-export { deleteWebTokenCookie, getCsrfToken, getJWToken, getToken, requestWebTokenSession, setToken, } from "./tokens";
+export { type AuthEventMap, type AuthEventName, emitAuthenticatedEvent, onAuthEvent, type SessionLostReason, type Unsubscribe, } from "./events/index.js";
+export { tryOAuthAuthentication, trySAMLAuthentication } from "./providers/index.js";
+export { clearSessionTokens, detectAuthMode, hasSession, isAuthenticated, isRedirectPending, login, logout, tryAutoAuthentication, } from "./session/index.js";
+export { deleteWebTokenCookie, getCsrfToken, getJWToken, getToken, requestWebTokenSession, setToken, } from "./tokens/index.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/authentication/providers/index.d.ts

@@ -1,3 +1,3 @@
-export { tryOAuthAuthentication } from "./oauth-authentication";
-export { trySAMLAuthentication } from "./saml-authentication";
+export { tryOAuthAuthentication } from "./oauth-authentication.js";
+export { trySAMLAuthentication } from "./saml-authentication.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/authentication/providers/oauth-authentication.d.ts

@@ -1,4 +1,4 @@
-import { type AtomicContext } from "../../client/atomic-context";
+import { type AtomicContext } from "../../client/atomic-context.js";
 /** @see tryOAuthAuthentication */
 export declare const tryOAuthAuthenticationWithContext: (ctx: AtomicContext) => Promise<{
     redirectUrl: string;

package/dist/authentication/providers/redirect-to-identity-provider.d.ts

@@ -1,4 +1,4 @@
-import { type AtomicContext } from "../../client/atomic-context";
+import { type AtomicContext } from "../../client/atomic-context.js";
 /** What differs between the OAuth and the SAML flows — everything else is shared. */
 declare const PROVIDER_KINDS: {
     readonly oauth: {

package/dist/authentication/providers/redirect-to-identity-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redirect-to-identity-provider.d.ts","sourceRoot":"","sources":["../../../src/authentication/providers/redirect-to-identity-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAInB,MAAM,6BAA6B,CAAC;AAKrC,qFAAqF;AACrF,QAAA,MAAM,cAAc;;;;;;;;;;;CAWV,CAAC;AAEX,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,MAAM,OAAO,cAAc,CAAC;IAClC,gGAAgG;IAChG,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;GASG;AACH,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,aAAa,EAClB,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,+BAA+B,GAClD,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAiDlC"}
+{"version":3,"file":"redirect-to-identity-provider.d.ts","sourceRoot":"","sources":["../../../src/authentication/providers/redirect-to-identity-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAInB,MAAM,6BAA6B,CAAC;AAKrC,qFAAqF;AACrF,QAAA,MAAM,cAAc;;;;;;;;;;;CAWV,CAAC;AAEX,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,MAAM,OAAO,cAAc,CAAC;IAClC,gGAAgG;IAChG,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;GASG;AACH,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,aAAa,EAClB,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,+BAA+B,GAClD,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAmDlC"}

package/dist/authentication/providers/saml-authentication.d.ts

@@ -1,4 +1,4 @@
-import { type AtomicContext } from "../../client/atomic-context";
+import { type AtomicContext } from "../../client/atomic-context.js";
 /** @see trySAMLAuthentication */
 export declare const trySAMLAuthenticationWithContext: (ctx: AtomicContext) => Promise<{
     redirectUrl: string;

package/dist/authentication/session/auth-mode-marker.d.ts

@@ -1,4 +1,4 @@
-import { type AtomicContext } from "../../client/atomic-context";
+import { type AtomicContext } from "../../client/atomic-context.js";
 /**
  * Persisted record — in `localStorage`, shared across tabs/windows unlike `sessionStorage` — of
  * whether the last successful authentication on this browser used `credentials`.

package/dist/authentication/session/auth-state.d.ts

@@ -1,4 +1,4 @@
-import { type AtomicContext } from "../../client/atomic-context";
+import { type AtomicContext } from "../../client/atomic-context.js";
 /**
  * Persisted "authenticated" flag for token-less ambient SSO — IIS Integrated Windows Authentication
  * or proxy SSO, where the server authenticates every request via the connection/cookie and issues

package/dist/authentication/session/detect-auth-mode.d.ts

@@ -1,5 +1,5 @@
-import { AuthMode } from "../../configurations";
-import type { CCAppPreLogin } from "../../types";
+import { AuthMode } from "../../configurations/index.js";
+import type { CCAppPreLogin } from "../../types/index.js";
 /**
  * Pure resolution of the authentication mode from the current configuration inputs and
  * the server pre-login response. No I/O, no `globalConfig` mutation, no `window` access.

package/dist/authentication/session/has-session.d.ts

@@ -1,4 +1,4 @@
-import { type AtomicContext } from "../../client/atomic-context";
+import { type AtomicContext } from "../../client/atomic-context.js";
 /**
  * Whether a session already exists for this context — **without ever redirecting**.
  *

package/dist/authentication/session/index.d.ts

@@ -1,8 +1,8 @@
-export { detectAuthMode } from "./detect-auth-mode";
-export { hasSession } from "./has-session";
-export { login } from "./login";
-export { clearSessionTokens, logout } from "./logout";
-export { isRedirectPending } from "./redirect-guard";
-export { tryAutoAuthentication } from "./try-auto-authentication";
-export { isAuthenticated } from "./user-authentication";
+export { detectAuthMode } from "./detect-auth-mode.js";
+export { hasSession } from "./has-session.js";
+export { login } from "./login.js";
+export { clearSessionTokens, logout } from "./logout.js";
+export { isRedirectPending } from "./redirect-guard.js";
+export { tryAutoAuthentication } from "./try-auto-authentication.js";
+export { isAuthenticated } from "./user-authentication.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/authentication/session/login.d.ts

@@ -1,5 +1,5 @@
-import { type AtomicContext } from "../../client/atomic-context";
-import type { Credentials } from "../../types";
+import { type AtomicContext } from "../../client/atomic-context.js";
+import type { Credentials } from "../../types/index.js";
 /**
  * Signs the user in on the given context.
  *

package/dist/authentication/session/logout.d.ts

@@ -1,9 +1,10 @@
-import { type AtomicContext } from "../../client/atomic-context";
+import { type AtomicContext } from "../../client/atomic-context.js";
 /**
  * Logs out the user of a context and deletes its web token cookie.
  *
- * @returns the logout `redirectUrl` returned by the server, or `undefined` when there is none to
- * follow — either because an impersonation is active (the cookie is left untouched), because the
+ * @returns the `logoutUrl` returned by the server (where to send the user to finish signing out at
+ * the identity provider, when it gave one), or `undefined` when there is none to follow — either
+ * because an impersonation is active (`userOverrideActive`: the cookie is NOT deleted), because the
  * server did not answer `ok`, or because the request failed (the failure is logged, not thrown).
  * The local session is cleared in every case.
  */

package/dist/authentication/session/logout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../../src/authentication/session/logout.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAKnB,MAAM,6BAA6B,CAAC;AAQrC;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CA6BvF;AAED,6BAA6B;AAC7B,wBAAsB,MAAM,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAE1D;AAED;;GAEG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI,CAStE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC"}
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../../src/authentication/session/logout.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAKnB,MAAM,6BAA6B,CAAC;AAQrC;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CA6BvF;AAED,6BAA6B;AAC7B,wBAAsB,MAAM,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAE1D;AAED;;GAEG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI,CAStE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC"}

package/dist/authentication/session/redirect-guard.d.ts

@@ -1,4 +1,4 @@
-import { type AtomicContext } from "../../client/atomic-context";
+import { type AtomicContext } from "../../client/atomic-context.js";
 /**
  * Whether a provider redirect (oauth / saml) was started for this context and has not established a
  * session yet.