@sinequa/atomic 2.2.0 → 2.3.0

package/dist/authentication/session/try-auto-authentication.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"try-auto-authentication.d.ts","sourceRoot":"","sources":["../../../src/authentication/session/try-auto-authentication.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,qBAAqB,QAAa,OAAO,CAAC,OAAO,CAgB7D,CAAC"}
+{"version":3,"file":"try-auto-authentication.d.ts","sourceRoot":"","sources":["../../../src/authentication/session/try-auto-authentication.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAGnB,MAAM,6BAA6B,CAAC;AAQrC;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,gCAAgC,GAC3C,KAAK,aAAa,KACjB,OAAO,CAAC,OAAO,CAiCjB,CAAC;AAEF,4CAA4C;AAC5C,eAAO,MAAM,qBAAqB,QAAO,OAAO,CAAC,OAAO,CACN,CAAC"}

package/dist/authentication/session/user-authentication.d.ts

@@ -1,9 +1,14 @@
+import { type AtomicContext } from "../../client/atomic-context";
 /**
- * Checks if the user is authenticated.
+ * Checks if the user is authenticated on the given context.
  *
  * True when a CSRF token is stored, OR when a token-less authenticated session was recorded — the
  * latter covers ambient SSO (IIS Integrated Windows Auth / proxy SSO), where the server authenticates
- * every request but issues no client token, so `getToken()` is `null` despite the user being signed in.
+ * every request but issues no client token, so the token is `null` despite the user being signed in.
+ */
+export declare const isAuthenticatedWithContext: (ctx: AtomicContext) => boolean;
+/**
+ * Checks if the user is authenticated.
  * @returns {boolean} True if the user is authenticated, false otherwise.
  */
 export declare const isAuthenticated: () => boolean;

package/dist/authentication/session/user-authentication.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-authentication.d.ts","sourceRoot":"","sources":["../../../src/authentication/session/user-authentication.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,QAAO,OACI,CAAC"}
+{"version":3,"file":"user-authentication.d.ts","sourceRoot":"","sources":["../../../src/authentication/session/user-authentication.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAEnB,MAAM,6BAA6B,CAAC;AAIrC;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,GAAI,KAAK,aAAa,KAAG,OACG,CAAC;AAEpE;;;GAGG;AACH,eAAO,MAAM,eAAe,QAAO,OACS,CAAC"}

package/dist/authentication/tokens/delete-web-token-cookie.d.ts

@@ -1,9 +1,14 @@
+import { type AtomicContext } from "../../client/atomic-context";
+/** Response of the `deleteWebTokenCookie` challenge action. */
+export type DeleteWebTokenCookieResult = {
+    methodresult: string;
+    logoutUrl?: string;
+};
 /**
- * Deletes the JSON Web Token (JWT) cookie by sending a GET request to the backend server.
+ * Deletes the JSON Web Token (JWT) cookie of a context by sending a GET request to the backend.
  * @returns A promise that resolves to the server response, containing `methodresult` set to `"ok"` on success.
  */
-export declare const deleteWebTokenCookie: () => Promise<{
-    methodresult: string;
-    logoutUrl?: string;
-}>;
+export declare const deleteWebTokenCookieWithContext: (ctx: AtomicContext) => Promise<DeleteWebTokenCookieResult>;
+/** @see deleteWebTokenCookieWithContext */
+export declare const deleteWebTokenCookie: () => Promise<DeleteWebTokenCookieResult>;
 //# sourceMappingURL=delete-web-token-cookie.d.ts.map

package/dist/authentication/tokens/delete-web-token-cookie.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delete-web-token-cookie.d.ts","sourceRoot":"","sources":["../../../src/authentication/tokens/delete-web-token-cookie.ts"],"names":[],"mappings":"AAIA;;;GAGG;AACH,eAAO,MAAM,oBAAoB;kBAQJ,MAAM;gBAAc,MAAM;EAKtD,CAAC"}
+{"version":3,"file":"delete-web-token-cookie.d.ts","sourceRoot":"","sources":["../../../src/authentication/tokens/delete-web-token-cookie.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAEnB,MAAM,6BAA6B,CAAC;AAKrC,+DAA+D;AAC/D,MAAM,MAAM,0BAA0B,GAAG;IACvC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,+BAA+B,GAC1C,KAAK,aAAa,KACjB,OAAO,CAAC,0BAA0B,CAcpC,CAAC;AAEF,2CAA2C;AAC3C,eAAO,MAAM,oBAAoB,QAAO,OAAO,CAAC,0BAA0B,CACzB,CAAC"}

package/dist/authentication/tokens/get-csrf-token.d.ts

@@ -1,5 +1,6 @@
+import { type AtomicContext } from "../../client/atomic-context";
 /**
- * Retrieves the CSRF token from the backend server.
+ * Retrieves the CSRF token from the backend server, on the given context.
  *
  * The endpoint is called with `suppressErrors=true`, so the server answers `200` **without a token**
  * when there is no session (instead of an error status, and without running the auth challenge). A
@@ -12,5 +13,7 @@
  * @returns The CSRF token string, or `null` when the server returns a `200` with no token.
  * @throws The underlying error on a genuine network / timeout / HTTP failure.
  */
+export declare const getCsrfTokenWithContext: (ctx: AtomicContext) => Promise<string | null>;
+/** @see getCsrfTokenWithContext */
 export declare const getCsrfToken: () => Promise<string | null>;
 //# sourceMappingURL=get-csrf-token.d.ts.map

package/dist/authentication/tokens/get-csrf-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-csrf-token.d.ts","sourceRoot":"","sources":["../../../src/authentication/tokens/get-csrf-token.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,YAAY,QAAa,OAAO,CAAC,MAAM,GAAG,IAAI,CAsB1D,CAAC"}
+{"version":3,"file":"get-csrf-token.d.ts","sourceRoot":"","sources":["../../../src/authentication/tokens/get-csrf-token.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAGnB,MAAM,6BAA6B,CAAC;AAMrC;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,uBAAuB,GAClC,KAAK,aAAa,KACjB,OAAO,CAAC,MAAM,GAAG,IAAI,CA0BvB,CAAC;AAEF,mCAAmC;AACnC,eAAO,MAAM,YAAY,QAAO,OAAO,CAAC,MAAM,GAAG,IAAI,CACZ,CAAC"}

package/dist/authentication/tokens/get-jwt-token.d.ts

@@ -1,16 +1,40 @@
+import { type AtomicContext } from "../../client/atomic-context";
 import type { Credentials } from "../../types";
 /**
- * Retrieves a JSON Web Token (JWT) using the provided credentials.
+ * Authenticates against `security.webtoken` on the given context.
+ *
+ * The JWT itself never reaches the client: the server sets it as a cookie (`tokenInCookie`). What
+ * comes back — and what this function stores and returns — is the **CSRF token** accompanying it.
+ *
+ * @param credentials - Username and password. Omit them to authenticate with the context's
+ *   configured `bearerToken`.
+ * @returns A promise that resolves to the CSRF token if successful, or `null` if none is returned.
+ * @throws An error if the request fails, or if no bearer token is configured for the
+ *   credential-less flow.
+ */
+export declare function requestWebTokenSessionWithContext(ctx: AtomicContext, credentials?: Credentials): Promise<string | null>;
+/**
+ * Authenticates against `security.webtoken` with the provided credentials.
+ *
+ * The JWT itself never reaches the client: the server sets it as a cookie (`tokenInCookie`). What
+ * comes back — and what this function stores and returns — is the **CSRF token** accompanying it.
+ *
  * @param credentials - The user's login credentials (username and password).
  * @returns A promise that resolves to the CSRF token if successful, or `null` if no token is returned.
  * @throws An error if the request to the backend fails.
  */
-export declare function getJWToken(credentials: Credentials): Promise<string | null>;
+export declare function requestWebTokenSession(credentials: Credentials): Promise<string | null>;
 /**
- * Retrieves a JSON Web Token (JWT) without explicit credentials.
- * Relies on a bearer token configured in `globalConfig` to authenticate the request.
+ * Authenticates against `security.webtoken` without explicit credentials, relying on the bearer
+ * token configured in `globalConfig`. As above, the returned value is the CSRF token.
+ *
  * @returns A promise that resolves to the CSRF token if successful, or `null` if no token is returned.
  * @throws An error if `bearerToken` is missing from `globalConfig` or if the request to the backend fails.
  */
-export declare function getJWToken(): Promise<string | null>;
+export declare function requestWebTokenSession(): Promise<string | null>;
+/**
+ * @deprecated Renamed to {@link requestWebTokenSession}: the name was misleading, as the JWT lands
+ * in a cookie and the returned value is the CSRF token. The alias will be removed in the next major.
+ */
+export declare const getJWToken: typeof requestWebTokenSession;
 //# sourceMappingURL=get-jwt-token.d.ts.map

package/dist/authentication/tokens/get-jwt-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-jwt-token.d.ts","sourceRoot":"","sources":["../../../src/authentication/tokens/get-jwt-token.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAO/C;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAC7E;;;;;GAKG;AACH,wBAAgB,UAAU,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC"}
+{"version":3,"file":"get-jwt-token.d.ts","sourceRoot":"","sources":["../../../src/authentication/tokens/get-jwt-token.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAGnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAM/C;;;;;;;;;;;GAWG;AACH,wBAAsB,iCAAiC,CACrD,GAAG,EAAE,aAAa,EAClB,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA2BxB;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAC1B;;;;;;GAMG;AACH,wBAAgB,sBAAsB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAKjE;;;GAGG;AACH,eAAO,MAAM,UAAU,+BAAyB,CAAC"}

package/dist/authentication/tokens/get-token.d.ts

@@ -1,6 +1,12 @@
+import { type AtomicContext } from "../../client/atomic-context";
+/**
+ * Retrieves the CSRF token of a context, first checking session storage then local storage.
+ * @returns The CSRF token string if found, or `null` if not present in either storage.
+ */
+export declare const getTokenWithContext: (ctx: AtomicContext) => string | null;
 /**
  * Retrieves the CSRF token, first checking session storage then local storage.
  * @returns The CSRF token string if found, or `null` if not present in either storage.
  */
-export declare const getToken: () => any;
+export declare const getToken: () => string | null;
 //# sourceMappingURL=get-token.d.ts.map

package/dist/authentication/tokens/get-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-token.d.ts","sourceRoot":"","sources":["../../../src/authentication/tokens/get-token.ts"],"names":[],"mappings":"AAMA;;;GAGG;AACH,eAAO,MAAM,QAAQ,WAmBpB,CAAC"}
+{"version":3,"file":"get-token.d.ts","sourceRoot":"","sources":["../../../src/authentication/tokens/get-token.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAKnB,MAAM,6BAA6B,CAAC;AAGrC;;;GAGG;AACH,eAAO,MAAM,mBAAmB,GAAI,KAAK,aAAa,KAAG,MAAM,GAAG,IA0BjE,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,QAAQ,QAAO,MAAM,GAAG,IACA,CAAC"}

package/dist/authentication/tokens/index.d.ts

@@ -1,6 +1,6 @@
 export { deleteWebTokenCookie } from "./delete-web-token-cookie";
 export { getCsrfToken } from "./get-csrf-token";
-export { getJWToken } from "./get-jwt-token";
+export { getJWToken, requestWebTokenSession } from "./get-jwt-token";
 export { getToken } from "./get-token";
 export { setToken } from "./set-token";
 //# sourceMappingURL=index.d.ts.map

package/dist/authentication/tokens/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/authentication/tokens/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/authentication/tokens/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC"}

package/dist/authentication/tokens/set-token.d.ts

@@ -1,5 +1,11 @@
+import { type AtomicContext } from "../../client/atomic-context";
 /**
- * Sets the CSRF token in session storage.
+ * Stores the CSRF token of a context and notifies its `tokenRefreshed` subscribers.
+ * @param token The CSRF token to store.
+ */
+export declare const setTokenWithContext: (ctx: AtomicContext, token: string) => void;
+/**
+ * Sets the CSRF token in session storage and notifies the `tokenRefreshed` subscribers.
  * @param token The CSRF token to store.
  */
 export declare const setToken: (token: string) => void;

package/dist/authentication/tokens/set-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"set-token.d.ts","sourceRoot":"","sources":["../../../src/authentication/tokens/set-token.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,eAAO,MAAM,QAAQ,GAAI,OAAO,MAAM,SAInC,CAAC"}
+{"version":3,"file":"set-token.d.ts","sourceRoot":"","sources":["../../../src/authentication/tokens/set-token.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAInB,MAAM,6BAA6B,CAAC;AAGrC;;;GAGG;AACH,eAAO,MAAM,mBAAmB,GAC9B,KAAK,aAAa,EAClB,OAAO,MAAM,KACZ,IAMF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,QAAQ,GAAI,OAAO,MAAM,KAAG,IACG,CAAC"}

package/dist/client/atomic-context.d.ts

@@ -0,0 +1,61 @@
+import { type AuthEventBus } from "../authentication/events/auth-events";
+import type { AtomicLogger, TokenStorage } from "../configurations/auth-options";
+import type { AppGlobalConfig } from "../configurations/global.config";
+import { type HttpAdapter } from "./http-adapter";
+/**
+ * Everything the authentication and HTTP layers read at runtime — configuration, event subscribers,
+ * storage namespace and transport. Every internal function takes one, so two clients configured for
+ * two backends never see each other's state.
+ *
+ * This is internal plumbing: applications get it through `createAtomicClient()`, and the free
+ * functions (`login`, `get`, …) run on {@link defaultContext}.
+ */
+export interface AtomicContext {
+    /**
+     * Read on every call, never copied — the default context points straight at `globalConfig`, so
+     * `setGlobalConfig()` keeps driving the free functions.
+     */
+    readonly config: Partial<AppGlobalConfig> & Record<string, unknown>;
+    /** Subscribers of this context only. */
+    readonly events: AuthEventBus;
+    /** Prepended to every Web Storage key, so two clients can keep separate sessions. */
+    readonly storagePrefix: string;
+    /** Resolved per call, so an SPFx client registered after start-up is still picked up. */
+    resolveHttpAdapter(): HttpAdapter | undefined;
+}
+/**
+ * The context backing the free functions. Its configuration IS `globalConfig` (by reference), and
+ * its storage keys are unprefixed — the historical behavior, unchanged.
+ */
+export declare const defaultContext: AtomicContext;
+/**
+ * Creates an isolated context on top of its own configuration object.
+ *
+ * With no `httpAdapter` of its own, the context uses the page's SPFx transport when there is one —
+ * exactly like {@link defaultContext}. An SPFx application registers a single `AadHttpClient` for
+ * the whole page, and a client created by `provideAtomicClient()` has to go through it too:
+ * otherwise its requests leave without the Azure AD bearer token, silently, and the server answers
+ * anonymously. Pass an explicit `httpAdapter` to override it — a second client targeting another
+ * backend (hence another AAD resource) needs its own.
+ */
+export declare function createContext(options: {
+    config: Partial<AppGlobalConfig> & Record<string, unknown>;
+    storagePrefix?: string;
+    httpAdapter?: HttpAdapter;
+}): AtomicContext;
+/** The logger of a context: the injected one, or the library logger. */
+export declare function contextLogger(ctx: AtomicContext): AtomicLogger;
+/** The `fetch` implementation of a context: the injected one, or the global `fetch`. */
+export declare function contextFetch(ctx: AtomicContext): typeof globalThis.fetch;
+/** The `credentials` mode applied to the requests of a context. Defaults to `"include"`. */
+export declare function contextCredentials(ctx: AtomicContext): RequestCredentials;
+/** The storage backing a scope for a context (injected one, Web Storage, then memory). */
+export declare function contextStorage(ctx: AtomicContext, scope: "session" | "local"): TokenStorage;
+/** Namespaces a storage key with the context prefix. */
+export declare function contextKey(ctx: AtomicContext, key: string): string;
+/**
+ * Merges a partial configuration into the context's own configuration. On the default context this
+ * mutates `globalConfig`, exactly like `setGlobalConfig`.
+ */
+export declare function patchConfig(ctx: AtomicContext, config: Partial<AppGlobalConfig> & Record<string, unknown>): void;
+//# sourceMappingURL=atomic-context.d.ts.map

package/dist/client/atomic-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomic-context.d.ts","sourceRoot":"","sources":["../../src/client/atomic-context.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,YAAY,EAGlB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EACV,YAAY,EACZ,YAAY,EACb,MAAM,gCAAgC,CAAC;AAExC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAIvE,OAAO,EAAyB,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAEzE;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpE,wCAAwC;IACxC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,qFAAqF;IACrF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,yFAAyF;IACzF,kBAAkB,IAAI,WAAW,GAAG,SAAS,CAAC;CAC/C;AAcD;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,aAK5B,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE;IACrC,MAAM,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B,GAAG,aAAa,CAShB;AAED,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,GAAG,EAAE,aAAa,GAAG,YAAY,CAE9D;AAED,wFAAwF;AACxF,wBAAgB,YAAY,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,UAAU,CAAC,KAAK,CAGxE;AAED,4FAA4F;AAC5F,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,aAAa,GAAG,kBAAkB,CAEzE;AAED,0FAA0F;AAC1F,wBAAgB,cAAc,CAC5B,GAAG,EAAE,aAAa,EAClB,KAAK,EAAE,SAAS,GAAG,OAAO,GACzB,YAAY,CAEd;AAED,wDAAwD;AACxD,wBAAgB,UAAU,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,aAAa,EAClB,MAAM,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACzD,IAAI,CAEN"}

package/dist/client/create-api.d.ts

@@ -0,0 +1,109 @@
+import type { AtomicContext } from "./atomic-context";
+/**
+ * The Sinequa API, bound to one client.
+ *
+ * Same functions as the free `fetchQuery`, `fetchPrincipal`, … exports, minus their trailing
+ * context parameter — every call goes to that client's backend, with that client's session.
+ */
+export declare function createApi(ctx: AtomicContext): {
+    app: {
+        /** Full application configuration. */
+        get: (appName?: string | undefined) => Promise<import("..").CCApp>;
+        /** Pre-login information (auth providers declared by the server). */
+        preLogin: () => Promise<import("..").CCAppPreLogin>;
+    };
+    principal: {
+        get: (options?: import("..").RequestOptions | undefined) => Promise<import("..").Principal>;
+        list: (options: {
+            search?: string;
+            isuser?: boolean;
+            isgroup?: boolean;
+        }) => Promise<import("..").Principal[]>;
+        userid: (userid: string) => Promise<import("..").Principal>;
+        userids: (userids: string[]) => Promise<import("..").Principal[]>;
+        /** Search-as-you-type lookup over users and groups. */
+        search: (params: {
+            offset: number;
+            limit: number;
+            search: string;
+        }, signal?: AbortSignal | undefined) => Promise<import("..").SecurityPrincipalSearchResponse>;
+    };
+    query: {
+        search: (query: import("..").Query, audit?: import("..").AuditEvents | undefined, queryIntentData?: import("..").QueryIntentData | undefined) => Promise<import("..").Result>;
+        bulk: (queries: import("..").Query[], mode?: "parallel" | undefined, auditEvents?: import("..").AuditEvents | undefined) => Promise<import("..").Result[]>;
+        intent: (query: import("..").Query) => Promise<import("..").QueryIntentMatch[]>;
+        export: (args_0: {
+            model: import("..").ExportQueryModel;
+            appName: string;
+            query: import("..").Query;
+            article?: import("..").Article;
+        }) => Promise<Response>;
+        aggregate: (aggregation: import("..").Aggregation, query: import("..").Query, audit?: import("..").AuditEvents | undefined) => Promise<import("..").Aggregation>;
+        sponsoredLinks: (webservice: string, query: import("..").Query) => Promise<import("..").LinkResult[]>;
+        similarDocuments: (documentId: string, queryName: string, signal?: AbortSignal | undefined) => Promise<import("..").Article[]>;
+    };
+    suggest: {
+        get: (suggestQueryName: string, text: string, filter?: Record<string, unknown> | undefined, kinds?: string[] | undefined, showSource?: boolean | undefined) => Promise<import("..").Suggestion[]>;
+        query: (suggestQueryName: string, text: string, queryName: string, fields?: string | string[] | undefined) => Promise<import("..").Suggestion[]>;
+        field: (text: string, fields: string[], query?: import("..").Query | undefined) => Promise<import("..").Suggestion[]>;
+    };
+    preview: {
+        get: (id: string, q: import("..").Query) => Promise<import("..").PreviewData>;
+        textChunks: (id: string, textChunks: import("..").TextLocation[], highlights: string[], query: import("..").Query, leftSentencesCount: number, rightSentencesCount: number) => Promise<{
+            chunks: import("..").TextChunk[];
+        }>;
+    };
+    labels: {
+        get: (prefix: string, publicOnly?: boolean | undefined, locale?: string | undefined) => Promise<string[]>;
+        rights: () => Promise<import("..").LabelsRights>;
+        add: (labels: string[], ids: string[], publicOnly?: boolean | undefined) => Promise<void>;
+        remove: (labels: string[], ids: string[], publicOnly?: boolean | undefined) => Promise<void>;
+        rename: (labels: string[], newLabel: string, publicOnly?: boolean | undefined) => Promise<void>;
+        delete: (labels: string[], publicOnly?: boolean | undefined) => Promise<void>;
+        bulkAdd: (labels: string[], query: import("..").Query, publicOnly?: boolean | undefined) => Promise<void>;
+        bulkRemove: (labels: string[], query: import("..").Query, publicOnly?: boolean | undefined) => Promise<void>;
+    };
+    dataset: {
+        get: <T extends import("..").Result = import("..").Result>(webserviceName: string, datasetName: string, parameters?: {} | undefined) => Promise<T>;
+        getMany: <T extends import("..").Result = import("..").Result>(webserviceName: string, options: {
+            parameters?: {};
+            datasets?: string[];
+        }) => Promise<import("..").DataSet<T>>;
+        list: (webserviceName: string) => Promise<import("..").DatasetDescription[]>;
+    };
+    userSettings: {
+        get: <T>() => Promise<T>;
+        save: <T>(userSettings: T, audit?: import("..").AuditEvents | undefined) => Promise<void>;
+        patch: <T>(userSettings: Partial<T>, audit?: import("..").AuditEvents | undefined) => Promise<T>;
+        reset: () => Promise<void>;
+    };
+    userProfile: {
+        get: (userId: string) => Promise<import("..").UserProfile>;
+        create: (userProfile: Partial<import("..").UserProfile>) => Promise<import("..").UserProfile>;
+        patch: (userProfile: Partial<Omit<import("..").UserProfile, "modified" | "created">>, category: string, propertyName: string) => Promise<import("..").UserProfile>;
+        deleteProperty: (userProfile: Partial<Omit<import("..").UserProfile, "modified" | "created">>, category: string, propertyName: string) => Promise<boolean>;
+    };
+    containers: {
+        list: (params?: {
+            page?: number;
+            pageSize?: number;
+        } | undefined) => Promise<import("..").ContainerListResponse>;
+        get: (id: string) => Promise<import("..").Container>;
+        create: (body: import("..").CreateContainerInput) => Promise<import("..").Container>;
+        update: (id: string, patch: import("..").UpdateContainerInput) => Promise<import("..").Container>;
+        delete: (containerIds: string[]) => Promise<import("..").DeleteContainersResult>;
+        listDocuments: (id: string, params?: {
+            page?: number;
+            pageSize?: number;
+        } | undefined) => Promise<import("..").ContainerDocumentListResponse>;
+        deleteDocuments: (id: string, fileIds: string[]) => Promise<void>;
+    };
+    password: {
+        change: (newPassword: string, currentPassword?: string | undefined) => Promise<import("..").ChangePasswordResponse>;
+        sendResetEmail: (userName: string) => Promise<import("..").PasswordResetEmailResponse>;
+    };
+    version: () => Promise<import("..").VersionResponse>;
+};
+/** The API surface of a client. @see createApi */
+export type AtomicApi = ReturnType<typeof createApi>;
+//# sourceMappingURL=create-api.d.ts.map

package/dist/client/create-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-api.d.ts","sourceRoot":"","sources":["../../src/client/create-api.ts"],"names":[],"mappings":"AAmDA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAsBtD;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,aAAa;;QAGtC,sCAAsC;;QAEtC,qEAAqE;;;;;;;;;;;;QAQrE,uDAAuD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+D5D;AAED,kDAAkD;AAClD,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC"}

package/dist/client/create-atomic-client.d.ts

@@ -0,0 +1,138 @@
+import type { AuthEventMap, AuthEventName, Unsubscribe } from "../authentication/events/auth-events";
+import type { AppGlobalConfig } from "../configurations/global.config";
+import type { API_ENDPOINTS, CCAppPreLogin, Credentials } from "../types";
+import { type DeleteOptions } from "../web-api/helpers/methods/del";
+import type { RequestOptions } from "../web-api/helpers/request-options";
+import { type AtomicContext } from "./atomic-context";
+import { type AtomicApi } from "./create-api";
+import type { HttpAdapter } from "./http-adapter";
+/**
+ * Configuration of a client created with {@link createAtomicClient}.
+ *
+ * Derived from {@link AppGlobalConfig} rather than redeclared as a subset: `createAtomicClient`
+ * copies **every** key it is handed into the client's configuration, so a type listing only some of
+ * them rejected values the client honors nonetheless — `autoOAuthProvider`, `autoSAMLProvider`,
+ * `uiLanguage`, `logLevel`, `createRoutes`. Applications worked around it with a cast, which then
+ * hid genuine mistakes too.
+ *
+ * The deprecated `useCredentials` / `useSSO` / `useSAML` booleans are excluded: they are read-only
+ * getters defined on `globalConfig` alone and have no equivalent on a client's configuration. Pass
+ * an {@link AuthMode} instead.
+ */
+export type AtomicClientConfig = Partial<Omit<AppGlobalConfig, "useCredentials" | "useSSO" | "useSAML">> & {
+    /**
+     * Sinequa application name. Optional, like every other configuration key: `initializeConfig()`
+     * derives it from the browser URL (`/app/<name>`) when it is missing, which is how an SPFx host
+     * supplying it at start-up works. Requiring it made spreading an application `environment` — a
+     * `Partial<AppGlobalConfig>` — fail to typecheck for no benefit.
+     */
+    app?: string;
+    /** Transport replacing `fetch` — e.g. `createSpfxHttpAdapter(aadHttpClient)`. */
+    httpAdapter?: HttpAdapter;
+    /**
+     * Prefix applied to the Web Storage keys. Defaults to `""`, so a client shares the session of the
+     * free functions — the common case. Give two clients distinct prefixes when they target different
+     * backends, otherwise they overwrite each other's token.
+     */
+    storagePrefix?: string;
+};
+/**
+ * An isolated Sinequa client: its own configuration, session and event subscribers.
+ *
+ * @experimental The shape may still change before it replaces the free functions.
+ */
+export interface AtomicClient {
+    /** Live view of the client's configuration (mutated by `configure`). */
+    readonly config: Readonly<Partial<AppGlobalConfig> & Record<string, unknown>>;
+    /**
+     * The prefix this client applies to its Web Storage keys — `""` when it shares the session of the
+     * free functions.
+     *
+     * Deliberately **not** part of `config`: the prefix is fixed when the client is created and
+     * `configure()` cannot change it, so exposing it there would be settable without effect. Read it
+     * to log or debug two clients apart.
+     */
+    readonly storagePrefix: string;
+    /** Merges values into the client's configuration. */
+    configure(config: Partial<AppGlobalConfig> & Record<string, unknown>): void;
+    /**
+     * Resolves the rest of the configuration before anything else runs: `backendUrl` and `app` from
+     * the browser URL when they were not provided, then the authentication mode from the server's
+     * pre-login response. Call it once, at start-up, before `auth.login()`.
+     */
+    initializeConfig(): Promise<CCAppPreLogin>;
+    auth: {
+        /** @see loginWithContext */
+        login(credentials?: Credentials): Promise<boolean>;
+        /** @see logoutWithContext */
+        logout(): Promise<string | undefined>;
+        /** Whether a token or a token-less session is recorded for this client. */
+        isAuthenticated(): boolean;
+        /**
+         * Whether a session is available, asking the server when nothing is stored — and **never
+         * redirecting**, unlike `login()`. @see hasSessionWithContext
+         */
+        hasSession(): Promise<boolean>;
+        /**
+         * Whether a provider redirect (oauth / saml) is in flight for this client and has not established
+         * a session yet. @see isRedirectPendingWithContext
+         */
+        isRedirectPending(): boolean;
+        /**
+         * Drops the client's local session (tokens, token-less flag, redirect guard) and notifies its
+         * subscribers, without any server round-trip. Use `logout()` to also delete the cookie.
+         */
+        clearSession(): void;
+        /** The stored CSRF token of this client, or `null`. */
+        getToken(): string | null;
+        /** Stores a CSRF token for this client and notifies its `tokenRefreshed` subscribers. */
+        setToken(token: string): void;
+        /** Subscribes to this client's authentication events. */
+        on<K extends AuthEventName>(event: K, handler: (payload: AuthEventMap[K]) => void): Unsubscribe;
+    };
+    http: {
+        get<T>(endpoint: API_ENDPOINTS, params?: URLSearchParams, options?: RequestOptions): Promise<T>;
+        post<T>(endpoint: API_ENDPOINTS, body: Record<string, unknown>, options?: RequestOptions): Promise<T>;
+        put<T>(endpoint: API_ENDPOINTS, body: Record<string, unknown>, options?: RequestOptions): Promise<T>;
+        patch<T>(endpoint: API_ENDPOINTS, body: Record<string, unknown>, options?: RequestOptions): Promise<T>;
+        del<T>(endpoint: API_ENDPOINTS, params?: URLSearchParams, options?: DeleteOptions): Promise<T>;
+    };
+    /**
+     * The Sinequa API bound to this client: `client.api.query.search(query)`,
+     * `client.api.principal.get()`, … Same functions as the free `fetchQuery`/`fetchPrincipal`
+     * exports, minus their trailing context parameter.
+     */
+    api: AtomicApi;
+    /** @internal The context every call of this client runs on. */
+    readonly context: AtomicContext;
+}
+/**
+ * Creates an independent Sinequa client.
+ *
+ * Unlike the free functions — which all share `globalConfig` — each client owns its configuration,
+ * its event subscribers and (with a `storagePrefix`) its session, so several backends can be
+ * queried from the same page.
+ *
+ * @experimental The shape may still change before it replaces the free functions.
+ *
+ * @example
+ * ```typescript
+ * const client = createAtomicClient({ app: "myapp", backendUrl: "https://backend" });
+ *
+ * client.auth.on("unauthorized", () => client.auth.login());
+ * await client.auth.login({ username, password });
+ * const results = await client.http.post("api/v1/search.query", { text: "hello" });
+ * ```
+ */
+export declare function createAtomicClient(config: AtomicClientConfig): AtomicClient;
+/**
+ * The client backing the free functions (`login`, `get`, …) — its configuration IS `globalConfig`.
+ *
+ * Use it to reach the object-oriented API from code that cannot receive a client instance (a
+ * distributed web component, a plugin), while keeping the very same session as the rest of the
+ * application.
+ *
+ * @experimental
+ */
+export declare function getDefaultClient(): AtomicClient;
+//# sourceMappingURL=create-atomic-client.d.ts.map

package/dist/client/create-atomic-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-atomic-client.d.ts","sourceRoot":"","sources":["../../src/client/create-atomic-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,YAAY,EACZ,aAAa,EACb,WAAW,EACZ,MAAM,sCAAsC,CAAC;AAW9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC1E,OAAO,EACL,KAAK,aAAa,EAEnB,MAAM,gCAAgC,CAAC;AAKxC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEzE,OAAO,EACL,KAAK,aAAa,EAInB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,KAAK,SAAS,EAAa,MAAM,cAAc,CAAC;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAElD;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,CACtC,IAAI,CAAC,eAAe,EAAE,gBAAgB,GAAG,QAAQ,GAAG,SAAS,CAAC,CAC/D,GAAG;IACF;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAE9E;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B,qDAAqD;IACrD,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAE5E;;;;OAIG;IACH,gBAAgB,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IAE3C,IAAI,EAAE;QACJ,4BAA4B;QAC5B,KAAK,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACnD,6BAA6B;QAC7B,MAAM,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;QACtC,2EAA2E;QAC3E,eAAe,IAAI,OAAO,CAAC;QAC3B;;;WAGG;QACH,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/B;;;WAGG;QACH,iBAAiB,IAAI,OAAO,CAAC;QAC7B;;;WAGG;QACH,YAAY,IAAI,IAAI,CAAC;QACrB,uDAAuD;QACvD,QAAQ,IAAI,MAAM,GAAG,IAAI,CAAC;QAC1B,yFAAyF;QACzF,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,yDAAyD;QACzD,EAAE,CAAC,CAAC,SAAS,aAAa,EACxB,KAAK,EAAE,CAAC,EACR,OAAO,EAAE,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,GAC1C,WAAW,CAAC;KAChB,CAAC;IAEF,IAAI,EAAE;QACJ,GAAG,CAAC,CAAC,EACH,QAAQ,EAAE,aAAa,EACvB,MAAM,CAAC,EAAE,eAAe,EACxB,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,CAAC,CAAC,CAAC;QACd,IAAI,CAAC,CAAC,EACJ,QAAQ,EAAE,aAAa,EACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,CAAC,CAAC,CAAC;QACd,GAAG,CAAC,CAAC,EACH,QAAQ,EAAE,aAAa,EACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,CAAC,CAAC,CAAC;QACd,KAAK,CAAC,CAAC,EACL,QAAQ,EAAE,aAAa,EACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,CAAC,CAAC,CAAC;QACd,GAAG,CAAC,CAAC,EACH,QAAQ,EAAE,aAAa,EACvB,MAAM,CAAC,EAAE,eAAe,EACxB,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,CAAC,CAAC,CAAC;KACf,CAAC;IAEF;;;;OAIG;IACH,GAAG,EAAE,SAAS,CAAC;IAEf,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;CACjC;AAyCD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,GAAG,YAAY,CAO3E;AAKD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,IAAI,YAAY,CAE/C"}

package/dist/client/http-adapter.d.ts

@@ -0,0 +1,30 @@
+import type { AadHttpClientLike, AadHttpResponseLike } from "../web-api/helpers/aad-http-client-manager";
+/** The request shape an {@link HttpAdapter} receives, mirroring the `fetch` init object. */
+export interface HttpAdapterRequest {
+    method: string;
+    headers: Headers;
+    body?: string;
+    signal?: AbortSignal;
+}
+/**
+ * Transport used instead of `fetch`. It exists for hosts that must issue requests through their own
+ * client — the SharePoint `AadHttpClient` being the reference case, since it attaches the Azure AD
+ * token itself.
+ */
+export interface HttpAdapter {
+    fetch(url: string, request: HttpAdapterRequest): Promise<AadHttpResponseLike | Response>;
+}
+/**
+ * Wraps an SPFx `AadHttpClient` into an {@link HttpAdapter}, so a client can be given the SharePoint
+ * transport explicitly instead of relying on the `initializeAadHttpClient` global.
+ *
+ * @example
+ * ```typescript
+ * const client = createAtomicClient({
+ *   app, backendUrl,
+ *   httpAdapter: createSpfxHttpAdapter(await context.aadHttpClientFactory.getClient(resource)),
+ * });
+ * ```
+ */
+export declare function createSpfxHttpAdapter(client: AadHttpClientLike): HttpAdapter;
+//# sourceMappingURL=http-adapter.d.ts.map

package/dist/client/http-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-adapter.d.ts","sourceRoot":"","sources":["../../src/client/http-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iBAAiB,EACjB,mBAAmB,EACpB,MAAM,4CAA4C,CAAC;AAEpD,4FAA4F;AAC5F,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,CACH,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,mBAAmB,GAAG,QAAQ,CAAC,CAAC;CAC5C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,iBAAiB,GAAG,WAAW,CAyB5E"}

package/dist/client/index.d.ts

@@ -0,0 +1,5 @@
+export type { AtomicContext } from "./atomic-context";
+export type { AtomicApi } from "./create-api";
+export { type AtomicClient, type AtomicClientConfig, createAtomicClient, getDefaultClient, } from "./create-atomic-client";
+export type { HttpAdapter, HttpAdapterRequest } from "./http-adapter";
+//# sourceMappingURL=index.d.ts.map

package/dist/client/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AACA,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,YAAY,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC"}